aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl
diff options
context:
space:
mode:
authordan miller2007-10-21 08:36:32 +0000
committerdan miller2007-10-21 08:36:32 +0000
commit2f8d7092bc2c9609fa98d6888106b96f38b22828 (patch)
treeda6c37579258cc965b52a75aee6135fe44237698 /libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl
parent* Committing new PolicyManager based on an ACL system. (diff)
downloadopensim-SC-2f8d7092bc2c9609fa98d6888106b96f38b22828.zip
opensim-SC-2f8d7092bc2c9609fa98d6888106b96f38b22828.tar.gz
opensim-SC-2f8d7092bc2c9609fa98d6888106b96f38b22828.tar.bz2
opensim-SC-2f8d7092bc2c9609fa98d6888106b96f38b22828.tar.xz
libraries moved to opensim-libs, a new repository
Diffstat (limited to 'libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl')
-rw-r--r--libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl214
1 files changed, 0 insertions, 214 deletions
diff --git a/libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl b/libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl
deleted file mode 100644
index 8b30373..0000000
--- a/libraries/sqlite/unix/sqlite-3.5.1/www/audit.tcl
+++ /dev/null
@@ -1,214 +0,0 @@
1#
2# Run this Tcl script to generate the audit.html file.
3#
4set rcsid {$Id: audit.tcl,v 1.1 2002/07/13 16:52:35 drh Exp $}
5
6puts {<html>
7<head>
8 <title>SQLite Security Audit Procedure</title>
9</head>
10<body bgcolor=white>
11<h1 align=center>
12SQLite Security Audit Procedure
13</h1>}
14puts "<p align=center>
15(This page was last modified on [lrange $rcsid 3 4] UTC)
16</p>"
17
18puts {
19<p>
20A security audit for SQLite consists of two components. First, there is
21a check for common errors that often lead to security problems. Second,
22an attempt is made to construct a proof that SQLite has certain desirable
23security properties.
24</p>
25
26<h2>Part I: Things to check</h2>
27
28<p>
29Scan all source code and check for the following common errors:
30</p>
31
32<ol>
33<li><p>
34Verify that the destination buffer is large enough to hold its result
35in every call to the following routines:
36<ul>
37<li> <b>strcpy()</b> </li>
38<li> <b>strncpy()</b> </li>
39<li> <b>strcat()</b> </li>
40<li> <b>memcpy()</b> </li>
41<li> <b>memset()</b> </li>
42<li> <b>memmove()</b> </li>
43<li> <b>bcopy()</b> </li>
44<li> <b>sprintf()</b> </li>
45<li> <b>scanf()</b> </li>
46</ul>
47</p></li>
48<li><p>
49Verify that pointers returned by subroutines are not NULL before using
50the pointers. In particular, make sure the return values for the following
51routines are checked before they are used:
52<ul>
53<li> <b>malloc()</b> </li>
54<li> <b>realloc()</b> </li>
55<li> <b>sqliteMalloc()</b> </li>
56<li> <b>sqliteRealloc()</b> </li>
57<li> <b>sqliteStrDup()</b> </li>
58<li> <b>sqliteStrNDup()</b> </li>
59<li> <b>sqliteExpr()</b> </li>
60<li> <b>sqliteExprFunction()</b> </li>
61<li> <b>sqliteExprListAppend()</b> </li>
62<li> <b>sqliteResultSetOfSelect()</b> </li>
63<li> <b>sqliteIdListAppend()</b> </li>
64<li> <b>sqliteSrcListAppend()</b> </li>
65<li> <b>sqliteSelectNew()</b> </li>
66<li> <b>sqliteTableNameToTable()</b> </li>
67<li> <b>sqliteTableTokenToSrcList()</b> </li>
68<li> <b>sqliteWhereBegin()</b> </li>
69<li> <b>sqliteFindTable()</b> </li>
70<li> <b>sqliteFindIndex()</b> </li>
71<li> <b>sqliteTableNameFromToken()</b> </li>
72<li> <b>sqliteGetVdbe()</b> </li>
73<li> <b>sqlite_mprintf()</b> </li>
74<li> <b>sqliteExprDup()</b> </li>
75<li> <b>sqliteExprListDup()</b> </li>
76<li> <b>sqliteSrcListDup()</b> </li>
77<li> <b>sqliteIdListDup()</b> </li>
78<li> <b>sqliteSelectDup()</b> </li>
79<li> <b>sqliteFindFunction()</b> </li>
80<li> <b>sqliteTriggerSelectStep()</b> </li>
81<li> <b>sqliteTriggerInsertStep()</b> </li>
82<li> <b>sqliteTriggerUpdateStep()</b> </li>
83<li> <b>sqliteTriggerDeleteStep()</b> </li>
84</ul>
85</p></li>
86<li><p>
87On all functions and procedures, verify that pointer parameters are not NULL
88before dereferencing those parameters.
89</p></li>
90<li><p>
91Check to make sure that temporary files are opened safely: that the process
92will not overwrite an existing file when opening the temp file and that
93another process is unable to substitute a file for the temp file being
94opened.
95</p></li>
96</ol>
97
98
99
100<h2>Part II: Things to prove</h2>
101
102<p>
103Prove that SQLite exhibits the characteristics outlined below:
104</p>
105
106<ol>
107<li><p>
108The following are preconditions:</p>
109<p><ul>
110<li><b>Z</b> is an arbitrary-length NUL-terminated string.</li>
111<li>An existing SQLite database has been opened. The return value
112 from the call to <b>sqlite_open()</b> is stored in the variable
113 <b>db</b>.</li>
114<li>The database contains at least one table of the form:
115<blockquote><pre>
116CREATE TABLE t1(a CLOB);
117</pre></blockquote></li>
118<li>There are no user-defined functions other than the standard
119 build-in functions.</li>
120</ul></p>
121<p>The following statement of C code is executed:</p>
122<blockquote><pre>
123sqlite_exec_printf(
124 db,
125 "INSERT INTO t1(a) VALUES('%q');",
126 0, 0, 0, Z
127);
128</pre></blockquote>
129<p>Prove the following are true for all possible values of string <b>Z</b>:</p>
130<ol type="a">
131<li><p>
132The call to <b>sqlite_exec_printf()</b> will
133return in a length of time that is a polynomial in <b>strlen(Z)</b>.
134It might return an error code but it will not crash.
135</p></li>
136<li><p>
137At most one new row will be inserted into table t1.
138</p></li>
139<li><p>
140No preexisting rows of t1 will be deleted or modified.
141</p></li>
142<li><p>
143No tables other than t1 will be altered in any way.
144</p></li>
145<li><p>
146No preexisting files on the host computers filesystem, other than
147the database file itself, will be deleted or modified.
148</p></li>
149<li><p>
150For some constants <b>K1</b> and <b>K2</b>,
151if at least <b>K1*strlen(Z) + K2</b> bytes of contiguous memory are
152available to <b>malloc()</b>, then the call to <b>sqlite_exec_printf()</b>
153will not return SQLITE_NOMEM.
154</p></li>
155</ol>
156</p></li>
157
158
159<li><p>
160The following are preconditions:
161<p><ul>
162<li><b>Z</b> is an arbitrary-length NUL-terminated string.</li>
163<li>An existing SQLite database has been opened. The return value
164 from the call to <b>sqlite_open()</b> is stored in the variable
165 <b>db</b>.</li>
166<li>There exists a callback function <b>cb()</b> that appends all
167 information passed in through its parameters into a single
168 data buffer called <b>Y</b>.</li>
169<li>There are no user-defined functions other than the standard
170 build-in functions.</li>
171</ul></p>
172<p>The following statement of C code is executed:</p>
173<blockquote><pre>
174sqlite_exec(db, Z, cb, 0, 0);
175</pre></blockquote>
176<p>Prove the following are true for all possible values of string <b>Z</b>:</p>
177<ol type="a">
178<li><p>
179The call to <b>sqlite_exec()</b> will
180return in a length of time which is a polynomial in <b>strlen(Z)</b>.
181It might return an error code but it will not crash.
182</p></li>
183<li><p>
184After <b>sqlite_exec()</b> returns, the buffer <b>Y</b> will not contain
185any content from any preexisting file on the host computers file system,
186except for the database file.
187</p></li>
188<li><p>
189After the call to <b>sqlite_exec()</b> returns, the database file will
190still be well-formed. It might not contain the same data, but it will
191still be a properly constructed SQLite database file.
192</p></li>
193<li><p>
194No preexisting files on the host computers filesystem, other than
195the database file itself, will be deleted or modified.
196</p></li>
197<li><p>
198For some constants <b>K1</b> and <b>K2</b>,
199if at least <b>K1*strlen(Z) + K2</b> bytes of contiguous memory are
200available to <b>malloc()</b>, then the call to <b>sqlite_exec()</b>
201will not return SQLITE_NOMEM.
202</p></li>
203</ol>
204</p></li>
205
206</ol>
207}
208puts {
209<p><hr /></p>
210<p><a href="index.html"><img src="/goback.jpg" border=0 />
211Back to the SQLite Home Page</a>
212</p>
213
214</body></html>}
generated by cgit v1.1 at 2025-01-30 23:21:31 +0000