Repository navigation
localStorage: a malformed backing file aborts the process via CHECK #65878
Description
Version
v27.0.0-pre (9f7ae86d8b5)
Platform
Darwin 25.6.0 arm64
Subsystem
webstorage, sqlite
What steps will reproduce the bug?
src/node_webstorage.cc asserts the SQLite type of every column it reads, but the backing file is a user-specified path. Node's own tables are STRICT, but the DDL is CREATE TABLE IF NOT EXISTS, so a file that already contains tables of those names is adopted as-is, STRICT or not.
// craft.cjs
const { DatabaseSync } = require('node:sqlite');
const out = '/tmp/ws.db';
for (const s of ['', '-wal', '-shm']) require('node:fs').rmSync(out + s, { force: true });
// Node's schema, minus STRICT. BLOB has no affinity, so a TEXT value stays TEXT.
const db = new DatabaseSync(out);
db.exec(`
CREATE TABLE nodejs_webstorage(
key BLOB NOT NULL, value BLOB NOT NULL, PRIMARY KEY(key));
CREATE TABLE nodejs_webstorage_state(
max_size INTEGER NOT NULL DEFAULT 10485760, total_size INTEGER NOT NULL,
schema_version INTEGER NOT NULL DEFAULT 1,
single_row_ INTEGER NOT NULL DEFAULT 1 CHECK(single_row_ = 1),
PRIMARY KEY(single_row_));
`);
// A real UTF-16LE key, so that lookups still match; only the value is TEXT.
db.prepare('INSERT INTO nodejs_webstorage (key, value) VALUES (?, ?)')
.run(Buffer.from('greeting', 'utf16le'), 'hello');
db.prepare('INSERT INTO nodejs_webstorage_state (total_size, schema_version)' +
' VALUES (0, 1)').run();
db.close();$ node craft.cjs
$ node --localstorage-file=/tmp/ws.db -e "localStorage.getItem('greeting')"How often does it reproduce? Is there a required condition?
The only condition is that the file exists with the wrong stored type.
What is the expected behavior? Why is that the expected behavior?
A thrown error.
What do you see instead?
SIGABRT, exit 134:
# node[96447]: MaybeLocal<Value> node::webstorage::Storage::Load(Local<Name>)
# at ../src/node_webstorage.cc:354
# Assertion failed: sqlite3_column_type(stmt.get(), 0) == 4
Additional information
Separately, line 187 re-runs init_sql_v0 and overwrites the result of the sqlite3_prepare_v2() five lines above it, so prepare failures go unreported. Given a nodejs_webstorage_state table with no schema_version column, the real error is replaced by Error: bad parameter or other API misuse.
Activity
src: throw on a malformed localStorage file
src: throw on a malformed localStorage file
src: throw on a malformed localStorage file
src: throw on a malformed localStorage file