sqldb/v2: ensure SqliteConfig.MaxConnections is used
What the developer wrote
Authored by Viktor Torstensson
sqldb/v2: ensure SqliteConfig.MaxConnections is used
What changed, and why it matters
This commit fixes a small configuration bug in LND's SQLite database setup. Previously, the user-supplied 'MaxConnections' setting was ignored and a hardcoded default was always used. Now the configured value is respected if it is greater than zero. This is a correctness fix rather than a clear security vulnerability, though ignoring a connection limit could theoretically contribute to resource exhaustion under unusual conditions.
Treat as a low-risk bug fix. No urgent security response is warranted unless operational experience shows the ignored limit caused resource exhaustion. Review whether defaultMaxConns is appropriate and consider adding validation bounds for cfg.MaxConnections.
Security signals we found
configuration value ignored (CWE-665 / CWE-1004-like)
resource limit not applied
potential for excessive database connections if default is higher than operator intent
Evidence from the diff
In sqldb/v2/sqlite.go, NewSqliteStore now checks cfg.MaxConnections and uses it when non-zero before calling db.SetMaxOpenConns. Previously it unconditionally passed defaultMaxConns, making the SqliteConfig.MaxConnections field ineffective. The change restores intended behavior for controlling the SQLite connection pool size.
Changed components
sqldb/v2/sqlite.goSQLite connection pool initialization in LNDInspect captured patch +6 / −1
diff --git a/sqldb/v2/sqlite.go b/sqldb/v2/sqlite.go
index 4aa4f37..209271b 100644
--- a/sqldb/v2/sqlite.go
+++ b/sqldb/v2/sqlite.go
@@ -136,7 +136,12 @@ func NewSqliteStore(cfg *SqliteConfig, dbPath string) (*SqliteStore, error) {
err)
}
- db.SetMaxOpenConns(defaultMaxConns)
+ maxConns := defaultMaxConns
+ if cfg.MaxConnections > 0 {
+ maxConns = cfg.MaxConnections
+ }
+
+ db.SetMaxOpenConns(maxConns)
db.SetMaxIdleConns(defaultMaxIdleConns)
db.SetConnMaxLifetime(defaultConnMaxLifetime)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.