Should we audit enabling loading of sqlite3 extensions (shared libraries)?

[erlendaasland (Erlend E. Aasland)]

@pf_moore

is there a good reason for not enabling extensions by default on Windows?

I don’t know. Historically, maybe for consistency across platforms? I’m fine with enabling it by default on Windows. I can create an issue for that on the tracker, unless you beat me to it.

Also, going back to my idea from earlier in this thread:

@erlendaasland

What I’m proposing is to use sqlite3_db_config iso. sqlite3_enable_load_extension, which implies that the SQL API only is disabled.

Now, that proposal is doomed (IMO), since someone is going to protest about the SQL API being denied. However, could expose the SQLite C API sqlite3_db_config in sqlite3 (together with SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION) so folks on macOS can enable extension loading the safe way. That would work on all platforms, so, as a side-effect, your app would be more portable.

Alternatively, we could tweak the sqlite3.Connection.enable_load_extension API to use sqlite3_db_config if sqlite3_enable_load_extension is not available.