René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"sqlite: track registered user-defined functions","articleBody":"### What is the problem this feature will solve?\n\nSQLite can invoke JavaScript through registered SQL functions during operations such as `database.applyChangeset()`, even when no `filter` or `onConflict` callback is supplied. For example, applying a row can evaluate a `CHECK` constraint that calls a JavaScript function.\n\nThis makes it unsafe to infer that an operation cannot execute JavaScript solely from the absence of explicit callbacks.\n\nPR #65870 addresses changeset buffer safety by copying non-empty changesets before applying them. Tracking registered functions would support follow-up work on callback safety and potential optimizations.\n\n### What is the feature you are proposing to solve the problem?\n\nAdd internal tracking of JavaScript-backed SQL functions registered on each `DatabaseSync` instance, including scalar and aggregate/window functions.\n\nThe tracking should remain accurate when functions are replaced and when the database is closed or reopened.\n\nUse this information to inform operation-specific safety checks. Any optimization that skips defensive copying must also account for other paths that can invoke JavaScript.\n\nPreventing function execution should be considered separately, with explicit compatibility review: existing schemas may depend on these functions in constraints, triggers, or expressions.\n\nRefs: https://github.com/nodejs/node/pull/65870#issuecomment-5571659917\n\n### What alternatives have you considered?\n\nContinue applying operation-specific protections without tracking registered functions. For changeset application, unconditional copying preserves existing function behavior while protecting the input buffer.","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-09-07T15:19:52Z","url":"https://github.com/nodejs/node/issues/65880"}