Client side database

[CrosRoad95]

Simple request, support for file database client side ( without remote database ).

Nowadays a lot of browsers have support for database.
Yes, i can store data in raw file, xml, but i database is easy to manage, fast.

[jushar]

I like the idea. However, I'm not sure if SQLite is secure enough, because some statements like the ATTACH statement allow for arbitrary filesystem access which could result in code execution (see https://resources.infosecinstitute.com/code-execution-and-privilege-escalation-databases/).

Either we'd need to investigate if it's possible to harden SQLite or do some research on alternative database systems.

[CrosRoad95]

You said that SQLite could be dangerous, but server side support sqllite, so i can already hack hosting ?

[patrikjuvonen]

@CrosRoad95 Server is responsible for handling the queries, therefore it is not vulnerable the same way as you can use parametrized SQL queries. On client-side you could do anything without the end-user knowing about it.

Edit: And if you meant your hosting service, you can't quite hack your hosting service, unless they're complete idiots.

[emre1702]

Predefined methods for insert, update and select could be possible or not?
Could be helpful to handle clientside settings and data.

[patrikjuvonen]

Can be injected.

We need a 100% reliable way to disable/deauth certain functions and keywords.

[Pirulax]

he stole my idea 😂
Nah, we discussed this, and I realized that there is no real reason for c.s. db.
Maybe @CrosRoad95 or someone has some ideas where they'd use c.s. db.

Why dont you use a json string which you are storing in a file ? I dont really think that databases should be clientsided as they would open security vulnerables

[prnxdev]

I don't see any contraindications. I web API there is something like IndexedDB which is client-side only. Also there is localStorage API which still is client-side only and is fully usable. Client side DB could be used to cache some simple informations, not whole sensitive data.

I agree that there should be client side DB.

[patrikjuvonen]

If we were to work on this issue, we'd have to find a good database candidate with client security as the priority.