|
|
Log in / Subscribe / Register

sqlite: unauthorized information access

sqlite: unauthorized information access

Posted Feb 12, 2010 18:37 UTC (Fri) by farnz (subscriber, #17727)
In reply to: sqlite: unauthorized information access by nlucas
Parent article: sqlite: unauthorized information access

Not quite - if I send you an SQLite file, you didn't have access to it before the deletion, but do now, you can read data I thought was deleted. Think of all the organisations that have been embarrassed by Word keeping change tracking revisions around in a document, for example.

I can't, off the top of my head, think of a real-world reason to distribute SQLite databases - but I can think of plenty of plausible reasons to do so (e.g. if you keep CDRs from an Asterisk box in SQLite), and it could get embarrassing if you disclosed information you thought had been deleted.

to post comments

sqlite: unauthorized information access

Posted Feb 12, 2010 18:54 UTC (Fri) by nlucas (subscriber, #33793) [Link]

You do have a point in there.

On the other hand SQLite (don't think it's in the SQL standard) has the VACUUM command for that kind of situations. No need to use a specific SQLite compile option, which will incur in a small performance loss for everybody using the same library.

But I accept that VACUUM is not something you want to do every time (or set the "auto-vacumm" flag).

sqlite: unauthorized information access

Posted Feb 15, 2010 9:42 UTC (Mon) by mfedyk (guest, #55303) [Link]

> I can't, off the top of my head, think of a real-world reason to distribute SQLite databases

I can. Sqlite recommends using them for your file format. But I believe they recommend compacting before doing so which probably removes deleted records as well.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds