db: drop support for sqlite3 < 3.14.
What the developer wrote
Authored by Rusty Russell
db: drop support for sqlite3 < 3.14.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit removes support for very old SQLite versions (before 3.14) in Core Lightning. It deletes a fallback mechanism that used SQLite's tracing feature to log expanded SQL statements when the newer sqlite3_expanded_sql function wasn't available. The change simplifies the code and requires SQLite 3.14 or newer. There is no direct security fix here, but running outdated SQLite versions can carry general security risks.
Ensure build and runtime environments use SQLite 3.14 or later. Review systems still running older SQLite versions, as they may have unpatched security issues. No immediate code-level mitigation is required.
Security signals we found
Removes fallback code path for old SQLite versions
Raises minimum SQLite version implicitly to 3.14
Eliminates use of deprecated sqlite3_trace API
Evidence from the diff
The commit drops the HAVE_SQLITE3_EXPANDED_SQL feature detection and the associated sqlite3_trace-based fallback in db_sqlite3_exec(). Previously, if SQLite < 3.14 lacked sqlite3_expanded_sql(), the code registered a trace callback to capture executed SQL. Now it unconditionally uses sqlite3_expanded_sql(). The configure script no longer tests for this function. This is a cleanup/minimum-version-bump, not a patch for a specific vulnerability.
Changed components
configuredb/db_sqlite3.cSQLite database backendInspect captured patch +4 / −56
diff --git a/configure b/configure
index 015af842..ebfe22af 100755
--- a/configure
+++ b/configure
@@ -429,20 +429,6 @@ int main(void)
return 0;
}
/*END*/
-var=HAVE_SQLITE3_EXPANDED_SQL
-desc=sqlite3_expanded_sql
-style=DEFINES_EVERYTHING|EXECUTE|MAY_NOT_COMPILE
-link=$SQLITE3_LDLIBS
-code=
-#include <sqlite3.h>
-#include <stdio.h>
-
-int main(void)
-{
- printf("%p\n", sqlite3_expanded_sql);
- return 0;
-}
-/*END*/
var=HAVE_SQLITE3
desc=sqlite3
style=DEFINES_EVERYTHING|EXECUTE|MAY_NOT_COMPILE
diff --git a/db/db_sqlite3.c b/db/db_sqlite3.c
index 8ee380a6..07ded41f 100644
--- a/db/db_sqlite3.c
+++ b/db/db_sqlite3.c
@@ -92,22 +92,6 @@ static bool have_same_data_version(sqlite3 *a, sqlite3 *b)
return version_a == version_b;
}
-#if !HAVE_SQLITE3_EXPANDED_SQL
-/* Prior to sqlite3 v3.14, we have to use tracing to dump statements */
-struct db_sqlite3_trace {
- struct db_sqlite3 *wrapper;
- struct db_stmt *stmt;
-};
-
-static void trace_sqlite3(void *stmtv, const char *stmt)
-{
- struct db_sqlite3_trace *trace = (struct db_sqlite3_trace *)stmtv;
- struct db_sqlite3 *wrapper = trace->wrapper;
- struct db_stmt *s = trace->stmt;
- db_sqlite3_changes_add(wrapper, s, stmt);
-}
-#endif
-
static const char *db_sqlite3_fmt_error(struct db_stmt *stmt)
{
return tal_fmt(stmt, "%s: %s: %s", stmt->location, stmt->query->query,
@@ -269,49 +253,27 @@ static bool db_sqlite3_query(struct db_stmt *stmt)
static bool db_sqlite3_exec(struct db_stmt *stmt)
{
int err;
- bool success;
+ char *expanded_sql;
struct db_sqlite3 *wrapper = (struct db_sqlite3 *) stmt->db->conn;
-#if !HAVE_SQLITE3_EXPANDED_SQL
- /* Register the tracing function if we don't have an explicit way of
- * expanding the statement. */
- struct db_sqlite3_trace trace;
- trace.wrapper = wrapper;
- trace.stmt = stmt;
- sqlite3_trace(conn2sql(stmt->db->conn), trace_sqlite3, &trace);
-#endif
-
if (!db_sqlite3_query(stmt)) {
/* If the prepare step caused an error we hand it up. */
- success = false;
- goto done;
+ return false;
}
err = sqlite3_step(stmt->inner_stmt);
if (err != SQLITE_DONE) {
tal_free(stmt->error);
stmt->error = db_sqlite3_fmt_error(stmt);
- success = false;
- goto done;
+ return false;
}
-#if HAVE_SQLITE3_EXPANDED_SQL
/* Manually expand and call the callback */
- char *expanded_sql;
expanded_sql = sqlite3_expanded_sql(stmt->inner_stmt);
db_sqlite3_changes_add(wrapper, stmt, expanded_sql);
sqlite3_free(expanded_sql);
-#endif
- success = true;
-
-done:
-#if !HAVE_SQLITE3_EXPANDED_SQL
- /* Unregister the trace callback to avoid it accessing the potentially
- * stale pointer to stmt */
- sqlite3_trace(conn2sql(stmt->db->conn), NULL, NULL);
-#endif
- return success;
+ return true;
}
static bool db_sqlite3_step(struct db_stmt *stmt)
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.