margelo / margelo/react-native-nitro-sqlite
Check sqlite3_bind return codes so extra parameters are not silently ignored
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 565
- Forks
- 53
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 18
Description
Summary
All sqlite3_bind_*() return codes are ignored. Supplying more parameters than a statement declares returns SQLITE_RANGE, but NitroSQLite continues to step the statement successfully, silently discarding the extra values.
Verified on main at ad8b835 (v9.7.0) and independently reproduced against SQLite.
Code evidence
operations.cpp#L120-L143 calls sqlite3_bind_null, sqlite3_bind_int, sqlite3_bind_int64, sqlite3_bind_double, sqlite3_bind_text, and sqlite3_bind_blob without inspecting their return values.
prepareStatement() then returns the statement and execution proceeds normally.
Smallest reproducer
const db = open({ name: 'bind.sqlite' })
// The SQL has one parameter, but two values are supplied.
const result = db.execute('SELECT ? AS value', [7, 8])
console.log(result.rows.item(0)?.value)
Expected: reject the mismatched parameter list with a NitroSQLiteError/SQLITE_RANGE error.
Observed: the query succeeds with value = 7; the extra 8 is silently ignored.
Independent SQLite C API result for the same sequence:
sqlite3_bind_int(statement, 1, 7) -> 0 (SQLITE_OK)
sqlite3_bind_int(statement, 2, 8) -> 25 (SQLITE_RANGE)
sqlite3_step(statement) -> 100 (SQLITE_ROW)
value -> 7
Impact
- Query-builder, ORM, migration, and application bugs can silently bind the wrong parameter set instead of failing close to the source.
- Batch commands can appear successful while extra values are discarded.
- Other bind errors (for example allocation-related failures) are also ignored and may surface later with misleading behavior.
Acceptance criteria
- Check every
sqlite3_bind_*()return code and throw a normalized SQL execution error when it is notSQLITE_OK. - Include the parameter index and SQLite error text/code without logging parameter values.
- Decide and document whether parameter count must match exactly using
sqlite3_bind_parameter_count(); at minimum, extra parameters must never be silently accepted. - Apply the same behavior to sync, async, batch, and future prepared-statement APIs through a shared bind implementation.
Regression-test target
Tests asserting that SELECT ? with [7, 8] rejects for sync, async, and batch execution, while a correctly sized parameter list still succeeds.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read packages/react-native-nitro-sqlite/cpp/operations.cpp around lines 120-143 and trace prepareStatement() to understand the binding path. Run or add regression coverage for sync, async, and batch execution: SELECT ? with [7, 8] must reject with indexed SQLite error details without parameter values, while correctly sized bindings succeed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, sqlite
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100