René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"sqlite: allow setting limits on inputs","articleBody":"### What is the problem this feature will solve?\n\nThe SQLite documentation describes in [Defence Against the Dark Arts](https://sqlite.org/security.html) techniques for defending against malicious SQL input in SQLite databases.\n\nIn #60217 I added support for the defensive flag, which prevents malicious input from corrupting the database.\n\nThe second item mentioned is setting limits on various inputs.\n\n### What is the feature you are proposing to solve the problem?\n\nThe [`sqlite3_limit()`](https://sqlite.org/c3ref/limit.html) API can be used to set limits. There are various [constants](https://sqlite.org/c3ref/c_limit_attached.html) such as `SQLITE_MAX_LENGTH` that can be used with it. More info: https://sqlite.org/limits.html\n\nI suggest that we allow configuring all limits by:\n\n- Allowing them to be passed on `DatabaseSync` construction.\n- Adding getters.\n- Adding setters.\n\n```js\nconst db = new DatabaseSync(':memory:', {\n  limits: {\n    length: 1000000,\n    sqlLength: 100000,\n    column: 100,\n    exprDepth: 10,\n    compoundSelect: 3,\n    vbdeOp: 25000,\n    functionArg: 8,\n    attach: 0,\n    likePatternLength: 50,\n    variableNumber: 10,\n    triggerDepth: 10\n  }\n});\n\n// getters\nt.assert(db.limits.length, 1000000);\nt.assert(db.limits.sqlLength, 1000000);\nt.assert(db.limits.column, 100);\nt.assert(db.limits.exprDepth, 10);\nt.assert(db.limits.compoundSelect, 3);\nt.assert(db.limits.vbdeOp, 25000);\nt.assert(db.limits.functionArg, 8);\nt.assert(db.limits.attach, 0);\nt.assert(db.limits.likePatternLength, 50);\nt.assert(db.limits.variableNumber, 10);\nt.assert(db.limits.triggerDepth, 10);\n\n// setters\ndb.limits.length = 1000000000;\ndb.limits.sqlLength = 1000000000;\ndb.limits.column = 2000;\ndb.limits.exprDepth = 1000;\ndb.limits.compoundSelect = 500;\ndb.limits.vbdeOp = 250000000;\ndb.limits.functionArg = 127;\ndb.limits.attach = 10;\ndb.limits.likePatternLength = 50000;\ndb.limits.variableNumber = 999;\ndb.limits.triggerDepth = 1000;\n```\n\n### What alternatives have you considered?\n\nInstead of using camelCase names for the limits, we could also expose constants `SQLITE_LIMIT_LENGTH`, `SQLITE_LIMIT_SQL_LENGTH` etc.\n\nHowever, I think it we should adopt a sensible  JavaScript API. This seems to be consistent with the overall API design of the SQLite module.\n\ncc @nodejs/sqlite ","author":{"url":"https://github.com/louwers","@type":"Person","name":"louwers"},"datePublished":"2026-01-04T00:03:12.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/61268/node/issues/61268"}