<story><title>Select Code_execution from * Using SQLite; (2019)</title><url>https://media.ccc.de/v/36c3-10701-select_code_execution_from_using_sqlite</url></story><parent_chain></parent_chain><comment><author>ysleepy</author><text>Combined with the correctness fuzzing results by SQLancer [1] where SQLite had 179 issues revealed (vs. 11 in PostgreSQL), I think the 100% coverage is a lot less meaningful than I had thought.&lt;p&gt;Robustness is not necessarily correctness and if the unit tests are just mirror images of the code, their results may help against regressions but little for correctness.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.manuelrigger.at&amp;#x2F;dbms-bugs&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.manuelrigger.at&amp;#x2F;dbms-bugs&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>Select Code_execution from * Using SQLite; (2019)</title><url>https://media.ccc.de/v/36c3-10701-select_code_execution_from_using_sqlite</url></story><parent_chain></parent_chain><comment><author>jiofih</author><text>This is surprising. SQLite is known for having 100% code coverage, fuzzy testing, and a 644:1 tests to code ratio. If even that cannot stop this kind of attack then we really need to rethink computers from the ground up...&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;sqlite.org&amp;#x2F;testing.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;sqlite.org&amp;#x2F;testing.html&lt;/a&gt;</text></comment>