Client side database about mtasa-blue HOT 9 CLOSED

I don't see any contraindications. I web API there is something like IndexedDB which is client-side only. Also there is localStorage API which still is client-side only and is fully usable. Client side DB could be used to cache some simple informations, not whole sensitive data.

I agree that there should be client side DB.

from mtasa-blue.

I like the idea. However, I'm not sure if SQLite is secure enough, because some statements like the ATTACH statement allow for arbitrary filesystem access which could result in code execution (see https://resources.infosecinstitute.com/code-execution-and-privilege-escalation-databases/).

Either we'd need to investigate if it's possible to harden SQLite or do some research on alternative database systems.

from mtasa-blue.

You said that SQLite could be dangerous, but server side support sqllite, so i can already hack hosting ?

from mtasa-blue.

@CrosRoad95 Server is responsible for handling the queries, therefore it is not vulnerable the same way as you can use parametrized SQL queries. On client-side you could do anything without the end-user knowing about it.

Edit: And if you meant your hosting service, you can't quite hack your hosting service, unless they're complete idiots.

from mtasa-blue.

Predefined methods for insert, update and select could be possible or not?
Could be helpful to handle clientside settings and data.

from mtasa-blue.

Can be injected.

We need a 100% reliable way to disable/deauth certain functions and keywords.

from mtasa-blue.

he stole my idea 😂
Nah, we discussed this, and I realized that there is no real reason for c.s. db.
Maybe @CrosRoad95 or someone has some ideas where they'd use c.s. db.

from mtasa-blue.

Why dont you use a json string which you are storing in a file ? I dont really think that databases should be clientsided as they would open security vulnerables

from mtasa-blue.

If we were to work on this issue, we'd have to find a good database candidate with client security as the priority.

from mtasa-blue.