pharo-rdbms / Pharo-SQLite3

Community-owned official SQLite3 binding for Pharo
MIT License
22 stars 20 forks source link

Some GLORP tests are failing for some SQLite library versions #24

Open gcotelli opened 4 years ago

gcotelli commented 4 years ago

GlorpBlobTest>>testBlob and GlorpBooleanTest>>#testBoolean are failing on the SQLite versions installed in the CI machines, but they work with version 3.32.3.

PR #23 marks them as expectedFailures if the library version is less than 3.32.2, but wold be good to understand why, because not all the Linux distributions comes with the last version of the library.

tblanchard commented 3 years ago

I found that SQLite has a limit on the size of an argument to like or glob.

See https://sqlite.org/limits.html

"The pattern matching algorithm used in the default LIKE and GLOB implementation of SQLite can exhibit O(N²) performance (where N is the number of characters in the pattern) for certain pathological cases. To avoid denial-of-service attacks from miscreants who are able to specify their own LIKE or GLOB patterns, the length of the LIKE or GLOB pattern is limited to SQLITE_MAX_LIKE_PATTERN_LENGTH bytes. The default value of this limit is 50000. A modern workstation can evaluate even a pathological LIKE or GLOB pattern of 50000 bytes relatively quickly. The denial of service problem only comes into play when the pattern length gets into millions of bytes. Nevertheless, since most useful LIKE or GLOB patterns are at most a few dozen bytes in length, paranoid application developers may want to reduce this parameter to something in the range of a few hundred if they know that external users are able to generate arbitrary patterns."

Unfortunately the fix is in the glorp SQLite3Platform in the glorp project. See https://github.com/pharo-rdbms/glorp/issues/34