fix(react-native): validate op-sqlite row carriers

Author: KyleAMathews

packages/react-native-db-sqlite-persistence/src/op-sqlite-driver.ts

@@ -152,6 +152,20 @@ function unsupportedQueryResult(sql: string, details?: string): never {
   )
 }
 
+function isValidRowList(
+  rowsObject: OpSQLiteRowListLike,
+): rowsObject is OpSQLiteRowListLike & {
+  length: number
+  item: (index: number) => unknown
+} {
+  return (
+    typeof rowsObject.length === `number` &&
+    Number.isSafeInteger(rowsObject.length) &&
+    rowsObject.length >= 0 &&
+    typeof rowsObject.item === `function`
+  )
+}
+
 function toRowArray(rowsValue: unknown): Array<unknown> | null {
   if (Array.isArray(rowsValue)) {
     return rowsValue
@@ -166,14 +180,10 @@ function toRowArray(rowsValue: unknown): Array<unknown> | null {
     return rowsObject._array
   }
 
-  if (
-    typeof rowsObject.length === `number` &&
-    typeof rowsObject.item === `function`
-  ) {
-    const item = rowsObject.item as (index: number) => unknown
+  if (isValidRowList(rowsObject)) {
     const rows: Array<unknown> = []
     for (let index = 0; index < rowsObject.length; index++) {
-      rows.push(item(index))
+      rows.push(rowsObject.item(index))
     }
     return rows
   }
@@ -191,11 +201,7 @@ function isRowCarrier(rowsValue: unknown): boolean {
   }
 
   const rowsObject = rowsValue as OpSQLiteRowListLike
-  return (
-    Array.isArray(rowsObject._array) ||
-    (typeof rowsObject.length === `number` &&
-      typeof rowsObject.item === `function`)
-  )
+  return Array.isArray(rowsObject._array) || isValidRowList(rowsObject)
 }
 
 function isStatementResultEnvelope(value: Record<string, unknown>): boolean {
@@ -340,6 +346,12 @@ function extractRowsFromExecuteResult(
 
   if (Array.isArray(result)) {
     if (result.length === 0) {
+      if (arrayResultMode === `statement-results`) {
+        return unsupportedQueryResult(
+          sql,
+          `statement-result arrays must contain exactly one result`,
+        )
+      }
       return []
     }
 

packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver.test.ts

@@ -295,6 +295,27 @@ it(`materializes a declared statement row list exactly once`, async () => {
   expect(requestedIndexes).toEqual([0, 1])
 })
 
+it.each([
+  { name: `NaN`, length: Number.NaN },
+  { name: `negative`, length: -1 },
+  { name: `fractional`, length: 1.5 },
+])(`rejects a $name statement row-list length`, async ({ length }) => {
+  await expect(
+    queryInjectedResult(
+      [{ rowsAffected: 0, rows: { length, item: () => ({ id: `row` }) } }],
+      `statement-results`,
+    ),
+  ).rejects.toThrow(`recognized statement envelope`)
+})
+
+it(`rejects an empty array in statement-results mode`, async () => {
+  await expect(queryInjectedResult([], `statement-results`)).rejects.toThrow(
+    `statement-result arrays must contain exactly one result`,
+  )
+  await expect(queryInjectedResult([], `rows`)).resolves.toEqual([])
+  await expect(queryInjectedResult([])).resolves.toEqual([])
+})
+
 it(`reads op-sqlite execute rows when columnNames metadata is also present`, async () => {
   await expect(
     queryInjectedResult({