sqlite: invalidate tag store iterators on statement reset

SQLTagStore Run/Iterate/Get/All reset the shared cached statement via
raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_
bump, so live iterators were never invalidated. Also mark the iterator
done on SQLITE_DONE so it cannot restart the statement.
PR-URL: nodejs-private/node-private#896
Refs: https://hackerone.com/reports/3564941
Reviewed-By: Robert Nagy <ronagy@icloud.com>
CVE-ID: CVE-2026-58041

Author: mcollina

src/node_sqlite.cc

@@ -3365,7 +3365,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
  }
 
 uint32_t n_params = args.Length() - 1;
-int r = sqlite3_reset(stmt->statement_);
+int r = stmt->ResetStatement();
 CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 int param_count = sqlite3_bind_parameter_count(stmt->statement_);
 for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
@@ -3398,7 +3398,7 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
  }
 
 uint32_t n_params = args.Length() - 1;
-int r = sqlite3_reset(stmt->statement_);
+int r = stmt->ResetStatement();
 CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 int param_count = sqlite3_bind_parameter_count(stmt->statement_);
 for (int i = 0; i < static_cast<int>(n_params) && i < param_count; ++i) {
@@ -3435,7 +3435,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 uint32_t n_params = args.Length() - 1;
  Isolate* isolate = env->isolate();
 
-int r = sqlite3_reset(stmt->statement_);
+int r = stmt->ResetStatement();
 CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
 
 int param_count = sqlite3_bind_parameter_count(stmt->statement_);
@@ -3474,7 +3474,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 uint32_t n_params = args.Length() - 1;
  Isolate* isolate = env->isolate();
 
-int r = sqlite3_reset(stmt->statement_);
+int r = stmt->ResetStatement();
 CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
 
 int param_count = sqlite3_bind_parameter_count(stmt->statement_);
@@ -3718,6 +3718,7 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
 CHECK_ERROR_OR_THROW(
  env->isolate(), iter->stmt_->db_.get(), r, SQLITE_DONE, void());
 sqlite3_reset(iter->stmt_->statement_);
+ iter->done_ = true;
  MaybeLocal<Value> values[] = {Boolean::New(isolate, true), Null(isolate)};
  Local<Object> result;
 if (NewDictionaryInstanceNullProto(env->context(), iter_template, values)

test/parallel/test-sqlite-template-tag.js

@@ -112,6 +112,114 @@ test('TagStore capacity, size, and clear', () => {
 assert.strictEqual(sql.capacity,10);
 });
 
+test('iterator is invalidated when the cached statement is reset',()=>{
+constldb=newDatabaseSync(':memory:');
+constlsql=ldb.createTagStore();
+ldb.exec('CREATE TABLE foo (id INTEGER PRIMARY KEY, text TEXT)');
+for(leti=0;i<5;i++){
+// eslint-disable-next-line no-unused-expressions
+lsql.run`INSERT INTO foo (text) VALUES (${String(i)})`;
+}
+
+// Invalidated by sql.get on the same tagged literal
+letit=lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+it.next();
+// eslint-disable-next-line no-unused-expressions
+lsql.get`SELECT * FROM foo ORDER BY id ASC`;
+assert.throws(()=>{it.next();},{
+code: 'ERR_INVALID_STATE',
+message: /iteratorwasinvalidated/,
+});
+
+// Invalidated by sql.all on the same tagged literal
+it=lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+it.next();
+// eslint-disable-next-line no-unused-expressions
+lsql.all`SELECT * FROM foo ORDER BY id ASC`;
+assert.throws(()=>{it.next();},{
+code: 'ERR_INVALID_STATE',
+message: /iteratorwasinvalidated/,
+});
+
+// Invalidated by sql.run on the same tagged literal
+it=lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+it.next();
+// eslint-disable-next-line no-unused-expressions
+lsql.run`SELECT * FROM foo ORDER BY id ASC`;
+assert.throws(()=>{it.next();},{
+code: 'ERR_INVALID_STATE',
+message: /iteratorwasinvalidated/,
+});
+
+// Invalidated by a new sql.iterate on the same tagged literal
+it=lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+it.next();
+constit2=lsql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+assert.throws(()=>{it.next();},{
+code: 'ERR_INVALID_STATE',
+message: /iteratorwasinvalidated/,
+});
+
+// The fresh iterator still works.
+assert.strictEqual(it2.next().done,false);
+
+ldb.close();
+});
+
+test('a stale iterator cannot replay a victim-bound write',()=>{
+constbank=newDatabaseSync(':memory:');
+consttx=bank.createTagStore();
+bank.exec(`
+ CREATE TABLE acct(user TEXT PRIMARY KEY, balance INTEGER);
+ CREATE TABLE transfers(id INTEGER PRIMARY KEY AUTOINCREMENT,
+ from_user TEXT, to_user TEXT, amount INTEGER);
+ CREATE TRIGGER debit AFTER INSERT ON transfers
+ BEGIN
+ UPDATE acct SET balance = balance - NEW.amount WHERE user = NEW.from_user;
+ UPDATE acct SET balance = balance + NEW.amount WHERE user = NEW.to_user;
+ END;
+ INSERT INTO acct VALUES ('victim', 1000);
+ INSERT INTO acct VALUES ('attacker', 0);
+ `);
+
+// Attacker arms an iterator without stepping it. The static parts of this
+// tagged literal must be byte-identical to the victim's below so they share
+// the same cached statement.
+constarmed=tx.iterate`INSERT INTO transfers(from_user, to_user, amount) VALUES (${'attacker'}, ${'attacker'}, ${0}) RETURNING id`;
+
+// Victim makes one legitimate transfer through the same tagged literal.
+// eslint-disable-next-line no-unused-expressions
+tx.get`INSERT INTO transfers(from_user, to_user, amount) VALUES (${'victim'}, ${'attacker'}, ${100}) RETURNING id`;
+
+// The stale iterator must not be able to replay the victim's write.
+assert.throws(()=>{armed.next();},{
+code: 'ERR_INVALID_STATE',
+message: /iteratorwasinvalidated/,
+});
+
+constbalances=bank.prepare('SELECT user, balance FROM acct ORDER BY user').all();
+assert.deepStrictEqual(balances,[
+{__proto__: null,user: 'attacker',balance: 100},
+{__proto__: null,user: 'victim',balance: 900},
+]);
+constcount=bank.prepare('SELECT COUNT(*) AS c FROM transfers').get().c;
+assert.strictEqual(count,1);
+
+bank.close();
+});
+
+test('a finished iterator stays done and does not restart',()=>{
+// eslint-disable-next-line no-unused-expressions
+sql.run`INSERT INTO foo (text) VALUES (${'bob'})`;
+
+constiter=sql.iterate`SELECT * FROM foo ORDER BY id ASC`;
+assert.strictEqual(iter.next().done,false);
+assert.strictEqual(iter.next().done,true);
+// A subsequent next() must not restart the statement.
+assert.strictEqual(iter.next().done,true);
+assert.strictEqual(iter.next().done,true);
+});
+
 test('sql.db returns the associated DatabaseSync instance',()=>{
 assert.strictEqual(sql.db,db);
 });