You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Paul Fitzpatrick 6e15d44cf6 (core) start applying defenses for untrusted document uploads ... Summary: This applies some mitigations suggested by SQLite authors when opening untrusted SQLite databases, as we do when Grist docs are uploaded by the user. See: https://www.sqlite.org/security.html#untrusted_sqlite_database_files Steps implemented in this diff are: * Setting `trusted_schema` to off * Running a SQLite-level integrity check on uploads Other steps will require updates to our node-sqlite3 fork, since they are not available via the node-sqlite3 api (one more reason to migrate to better-sqlite3). I haven't yet managed to create a file that triggers an integrity check failure without also being detected as corruption by sqlite at a more basic level, so that is a TODO for testing. Test Plan: existing tests pass; need to come up with exploits to actually test the defences and have not yet Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2909		3 years ago
..
nbrowser	(core) Refactoring google drive plugin	3 years ago
server	(core) start applying defenses for untrusted document uploads	3 years ago
init-mocha-webdriver.js	(core) freshen grist-core build	3 years ago
mocha.opts	(core) Move report-why-tests-hang helper to core	3 years ago
report-why-tests-hang.js	(core) Move report-why-tests-hang helper to core	3 years ago
tsconfig.json	(core) freshen grist-core build	3 years ago
xunit-file.js	(core) freshen grist-core build	3 years ago