sqlite: validate connection after reading options

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>

Author: lazerg

src/node_sqlite.cc

@@ -1908,6 +1908,9 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     argc = js_len.As<Int32>()->Value();
   }
 
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   UserDefinedFunction* user_data = new UserDefinedFunction(
       env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
@@ -2070,6 +2073,12 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env,
+      db->IsInCallback(),
+      "database cannot be deserialized while in a callback");
+
   // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
   // transfers ownership to SQLite, which calls sqlite3_free() on close.
   // See: https://www.sqlite.org/c3ref/deserialize.html
@@ -2229,6 +2238,9 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
     argc = std::max({argc, js_len.As<Int32>()->Value() - 1, 0});
   }
 
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   int text_rep = SQLITE_UTF8;
   if (direct_only) {
     text_rep |= SQLITE_DIRECTONLY;
@@ -2441,6 +2453,8 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Local<Promise::Resolver> resolver;
   if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) {
     return;

test/parallel/test-sqlite-close-from-options-getter.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const tmpdir = require('../common/tmpdir');
+const assert = require('node:assert');
+const { join } = require('node:path');
+const { test } = require('node:test');
+const { backup, DatabaseSync } = require('node:sqlite');
+
+tmpdir.refresh();
+
+const closedError = {
+  code: 'ERR_INVALID_STATE',
+  message: 'database is not open',
+};
+
+// Reading the options bag runs a user getter, so the connection validated on
+// entry can already be closed by the time the method reaches SQLite.
+test('function() with a getter that closes the database', () => {
+  const db = new DatabaseSync(':memory:');
+  const options = {
+    get useBigIntArguments() {
+      db.close();
+      return false;
+    },
+  };
+
+  assert.throws(() => {
+    db.function('custom', options, () => 1);
+  }, closedError);
+});
+
+test('aggregate() with a getter that closes the database', () => {
+  const db = new DatabaseSync(':memory:');
+  const options = {
+    start: 0,
+    step: (acc, value) => acc + value,
+    get useBigIntArguments() {
+      db.close();
+      return false;
+    },
+  };
+
+  assert.throws(() => {
+    db.aggregate('custom', options);
+  }, closedError);
+});
+
+test('deserialize() with a getter that closes the database', () => {
+  const source = new DatabaseSync(':memory:');
+  source.exec('CREATE TABLE data (value INTEGER)');
+  const serialized = source.serialize();
+  source.close();
+
+  const db = new DatabaseSync(':memory:');
+  const options = {
+    get dbName() {
+      db.close();
+      return 'main';
+    },
+  };
+
+  assert.throws(() => {
+    db.deserialize(serialized, options);
+  }, closedError);
+});
+
+test('backup() with a getter that closes the database', () => {
+  const db = new DatabaseSync(':memory:');
+  db.exec('CREATE TABLE data (value INTEGER)');
+  const options = {
+    get rate() {
+      db.close();
+      return 1;
+    },
+  };
+
+  assert.throws(() => {
+    backup(db, join(tmpdir.path, 'backup.db'), options);
+  }, closedError);
+});