sqlite: clear SQLTagStore bindings

SQLTagStore reused cached statements without clearing values bound by a
previous execution. Clear bindings before binding new values and reject
parameters that do not correspond to template substitutions.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #65041
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Author: mcollina

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);

src/node_sqlite.cc

@@ -3431,6 +3431,35 @@ void SQLTagStore::SizeGetter(const FunctionCallbackInfo<Value>& args) {
  args.GetReturnValue().Set(static_cast<double>(store->sql_tags_.Size()));
 }
 
+boolSQLTagStore::ResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const FunctionCallbackInfo<Value>& args) {
+ Isolate* isolate = env->isolate();
+int r = stmt->ResetStatement();
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+ r = sqlite3_clear_bindings(stmt->statement_);
+CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, false);
+
+uint32_t n_params = args.Length() - 1;
+int param_count = sqlite3_bind_parameter_count(stmt->statement_);
+if (param_count != static_cast<int>(n_params)) {
+THROW_ERR_INVALID_ARG_VALUE(
+ env,
+"SQLite parameters must be bound using template literal placeholders.");
+returnfalse;
+ }
+
+for (int i = 0; i < param_count; ++i) {
+if (!stmt->BindValue(args[i + 1], i + 1)) {
+returnfalse;
+ }
+ }
+
+returntrue;
+}
+
 voidSQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  SQLTagStore* session;
 ASSIGN_OR_RETURN_UNWRAP(&session, args.This());
@@ -3445,15 +3474,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Object> result;
@@ -3478,15 +3500,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  BaseObjectPtr<StatementSyncIterator> iter = StatementExecutionHelper::Iterate(
@@ -3513,18 +3528,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
  Local<Value> result;
@@ -3552,18 +3557,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 return;
  }
 
-uint32_t n_params = args.Length() - 1;
- Isolate* isolate = env->isolate();
-
-int r = stmt->ResetStatement();
-CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
-
-int param_count = sqlite3_bind_parameter_count(stmt->statement_);
-for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
- Local<Value> value = args[i + 1];
-if (!stmt->BindValue(value, i + 1)) {
-return;
- }
+if (!ResetAndBindStatement(env, stmt.get(), args)) {
+return;
  }
 
 auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt->statement_); });

src/node_sqlite.h

@@ -404,6 +404,10 @@ class SQLTagStore : public BaseObject {
 private:
 static BaseObjectPtr<StatementSync> PrepareStatement(
 const v8::FunctionCallbackInfo<v8::Value>& args);
+staticboolResetAndBindStatement(
+ Environment* env,
+ StatementSync* stmt,
+const v8::FunctionCallbackInfo<v8::Value>& args);
  BaseObjectWeakPtr<DatabaseSync> database_;
  LRUCache<std::string, BaseObjectPtr<StatementSync>> sql_tags_;
 friendclassStatementExecutionHelper;

test/parallel/test-sqlite-template-tag.js

@@ -90,6 +90,43 @@ test('queries with no results', () => {
 assert.strictEqual(count,0);
 });
 
+test('rejects parameters outside of template expressions',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec(`
+ CREATE TABLE secrets(owner TEXT, token TEXT);
+ INSERT INTO secrets VALUES ('victim', 'secret');
+ CREATE TABLE transfers(from_user TEXT, amount INTEGER);
+ `);
+
+constexpectedError={
+code: 'ERR_INVALID_ARG_VALUE',
+message: /mustbeboundusingtemplateliteralplaceholders/,
+};
+
+for(constmethodof['get','all','iterate']){
+// Prime the cached statement with a bound value before each attempt.
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT token FROM secrets WHERE owner = ${'victim'}`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql[method]`SELECT token FROM secrets WHERE owner = ?`;
+},expectedError);
+}
+
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (${'victim'},${100})`;
+assert.throws(()=>{
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO transfers VALUES (?,?)`;
+},expectedError);
+assert.strictEqual(
+ldb.prepare('SELECT COUNT(*) AS count FROM transfers').get().count,
+1);
+
+ldb.close();
+});
+
 test('TagStore capacity, size, and clear',()=>{
 assert.strictEqual(sql.capacity,10);
 assert.strictEqual(sql.size,0);