sqlite: invalidate tag store iterators on statement reset

SQLTagStore Run/Iterate/Get/All reset the shared cached statement via
raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_
bump, so live iterators were never invalidated. Also mark the iterator
done on SQLITE_DONE so it cannot restart the statement.

PR-URL: nodejs-private/node-private#896
Refs: https://hackerone.com/reports/3564941
Reviewed-By: Robert Nagy <ronagy@icloud.com>
CVE-ID: CVE-2026-58041

Author: mcollina

src/node_sqlite.cc

@@ -3365,7 +3365,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
   }
 
   uint32_t n_params = args.Length() - 1;
-  int r = sqlite3_reset(stmt->statement_);
+  int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
   int param_count = sqlite3_bind_parameter_count(stmt->statement_);
   for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
@@ -3398,7 +3398,7 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
   }
 
   uint32_t n_params = args.Length() - 1;
-  int r = sqlite3_reset(stmt->statement_);
+  int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
   int param_count = sqlite3_bind_parameter_count(stmt->statement_);
   for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
@@ -3435,7 +3435,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
   uint32_t n_params = args.Length() - 1;
   Isolate* isolate = env->isolate();
 
-  int r = sqlite3_reset(stmt->statement_);
+  int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
 
   int param_count = sqlite3_bind_parameter_count(stmt->statement_);
@@ -3474,7 +3474,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
   uint32_t n_params = args.Length() - 1;
   Isolate* isolate = env->isolate();
 
-  int r = sqlite3_reset(stmt->statement_);
+  int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
 
   int param_count = sqlite3_bind_parameter_count(stmt->statement_);
@@ -3718,6 +3718,7 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
     CHECK_ERROR_OR_THROW(
         env->isolate(), iter->stmt_->db_.get(), r, SQLITE_DONE, void());
     sqlite3_reset(iter->stmt_->statement_);
+    iter->done_ = true;
     MaybeLocal<Value> values[] = {Boolean::New(isolate, true), Null(isolate)};
     Local<Object> result;
     if (NewDictionaryInstanceNullProto(env->context(), iter_template, values)

test/parallel/test-sqlite-template-tag.js

@@ -112,6 +112,114 @@ test('TagStore capacity, size, and clear', () => {
   assert.strictEqual(sql.capacity, 10);
 });
 
+test('iterator is invalidated when the cached statement is reset', () => {
+  const ldb = new DatabaseSync(':memory:');
+  const lsql = ldb.createTagStore();
+  ldb.exec('CREATE TABLE foo (id INTEGER PRIMARY KEY, text TEXT)');
+  for (let i = 0; i < 5; i++) {
+    // eslint-disable-next-line no-unused-expressions
+    lsql.run`INSERT INTO foo (text) VALUES (${String(i)})`;
+  }
+
+  // Invalidated by sql.get on the same tagged literal
+  let it = lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  it.next();
+  // eslint-disable-next-line no-unused-expressions
+  lsql.get`SELECT * FROM foo ORDER BY id ASC`;
+  assert.throws(() => { it.next(); }, {
+    code: 'ERR_INVALID_STATE',
+    message: /iterator was invalidated/,
+  });
+
+  // Invalidated by sql.all on the same tagged literal
+  it = lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  it.next();
+  // eslint-disable-next-line no-unused-expressions
+  lsql.all`SELECT * FROM foo ORDER BY id ASC`;
+  assert.throws(() => { it.next(); }, {
+    code: 'ERR_INVALID_STATE',
+    message: /iterator was invalidated/,
+  });
+
+  // Invalidated by sql.run on the same tagged literal
+  it = lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  it.next();
+  // eslint-disable-next-line no-unused-expressions
+  lsql.run`SELECT * FROM foo ORDER BY id ASC`;
+  assert.throws(() => { it.next(); }, {
+    code: 'ERR_INVALID_STATE',
+    message: /iterator was invalidated/,
+  });
+
+  // Invalidated by a new sql.iterate on the same tagged literal
+  it = lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  it.next();
+  const it2 = lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  assert.throws(() => { it.next(); }, {
+    code: 'ERR_INVALID_STATE',
+    message: /iterator was invalidated/,
+  });
+
+  // The fresh iterator still works.
+  assert.strictEqual(it2.next().done, false);
+
+  ldb.close();
+});
+
+test('a stale iterator cannot replay a victim-bound write', () => {
+  const bank = new DatabaseSync(':memory:');
+  const tx = bank.createTagStore();
+  bank.exec(`
+    CREATE TABLE acct(user TEXT PRIMARY KEY, balance INTEGER);
+    CREATE TABLE transfers(id INTEGER PRIMARY KEY AUTOINCREMENT,
+      from_user TEXT, to_user TEXT, amount INTEGER);
+    CREATE TRIGGER debit AFTER INSERT ON transfers
+      BEGIN
+        UPDATE acct SET balance = balance - NEW.amount WHERE user = NEW.from_user;
+        UPDATE acct SET balance = balance + NEW.amount WHERE user = NEW.to_user;
+      END;
+    INSERT INTO acct VALUES ('victim',   1000);
+    INSERT INTO acct VALUES ('attacker',    0);
+  `);
+
+  // Attacker arms an iterator without stepping it. The static parts of this
+  // tagged literal must be byte-identical to the victim's below so they share
+  // the same cached statement.
+  const armed = tx.iterate`INSERT INTO transfers(from_user, to_user, amount) VALUES (${'attacker'}, ${'attacker'}, ${0}) RETURNING id`;
+
+  // Victim makes one legitimate transfer through the same tagged literal.
+  // eslint-disable-next-line no-unused-expressions
+  tx.get`INSERT INTO transfers(from_user, to_user, amount) VALUES (${'victim'}, ${'attacker'}, ${100}) RETURNING id`;
+
+  // The stale iterator must not be able to replay the victim's write.
+  assert.throws(() => { armed.next(); }, {
+    code: 'ERR_INVALID_STATE',
+    message: /iterator was invalidated/,
+  });
+
+  const balances = bank.prepare('SELECT user, balance FROM acct ORDER BY user').all();
+  assert.deepStrictEqual(balances, [
+    { __proto__: null, user: 'attacker', balance: 100 },
+    { __proto__: null, user: 'victim', balance: 900 },
+  ]);
+  const count = bank.prepare('SELECT COUNT(*) AS c FROM transfers').get().c;
+  assert.strictEqual(count, 1);
+
+  bank.close();
+});
+
+test('a finished iterator stays done and does not restart', () => {
+  // eslint-disable-next-line no-unused-expressions
+  sql.run`INSERT INTO foo (text) VALUES (${'bob'})`;
+
+  const iter = sql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+  assert.strictEqual(iter.next().done, false);
+  assert.strictEqual(iter.next().done, true);
+  // A subsequent next() must not restart the statement.
+  assert.strictEqual(iter.next().done, true);
+  assert.strictEqual(iter.next().done, true);
+});
+
 test('sql.db returns the associated DatabaseSync instance', () => {
   assert.strictEqual(sql.db, db);
 });