From e89208468093147b33967f38c6964c588fca41be Mon Sep 17 00:00:00 2001
From: drh <>
Date: Sat, 10 Oct 2026 18:40:16 +0000
Subject: [PATCH] In the CLI, disallow any use of the fileio extension in
 --safe mode. [bugs:/info/2026-10-10T13:15:05Z|Bug 2026-10-10T13:15:05Z]

FossilOrigin-Name: e3e5ef4e17373677e1cc589ac79e20f6fb523e60fe8afdbc0b92f12cc75cff8b
---
 manifest          | 17 +++++++++--------
 manifest.uuid     |  2 +-
 src/shell.c.in    |  4 +++-
 test/safemode.sql | 31 +++++++++++++++++++++++++++++++
 test/shell2.test  |  4 +++-
 test/shellB.test  |  8 +++++++-
 6 files changed, 54 insertions(+), 12 deletions(-)
 create mode 100644 test/safemode.sql

diff --git a/manifest b/manifest
index dd4f37adc8..76f23397e9 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improved\serror\shandling\sin\sthe\s".import"\scommand\sof\sthe\sCLI.\n[forum:/info/2026-10-09T17:57:07Z|Forum\spost\s2026-10-09T17:57:07Z].
-D 2026-10-09T18:34:26.406
+C In\sthe\sCLI,\sdisallow\sany\suse\sof\sthe\sfileio\sextension\sin\s--safe\smode.\n[bugs:/info/2026-10-10T13:15:05Z|Bug\s2026-10-10T13:15:05Z]
+D 2026-10-10T18:40:16.105
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -802,7 +802,7 @@ F src/random.c 606b00941a1d7dd09c381d3279a058d771f406c5213c9932bbd93d5587be4b9c
 F src/resolve.c 0e0990f60c93db38c735d85e5d1741130e72dd0670aec204b5a39118b53c8044
 F src/rowset.c 8432130e6c344b3401a8874c3cb49fefe6873fec593294de077afea2dce5ec97
 F src/select.c f6ad8bbf82f21a32c68ce3d885f1a960469d48efde93f432f5ba680869ae64f6
-F src/shell.c.in 86bf0d0e2aeb8348892098e4f42367a2200a89822181d23b3a9bb0df40a7630c
+F src/shell.c.in 5968e51d260f72f3ac074ca435b041324c7e5b04702e7e0e3cab4261ce5dda67
 F src/sqlite.h.in 648fdc66f52433fc0f6cf9564ac924cde544eca9605bbac36aa22d8c944f11ed
 F src/sqlite3.rc 015537e6ac1eec6c7050e17b616c2ffe6f70fca241835a84a4f0d5937383c479
 F src/sqlite3ext.h 5e113c4c0442f2f1b3345d44cbe4b82fad45f2fc0c35f0ed4eef27fb8f1cb394
@@ -1648,6 +1648,7 @@ F test/rowvaluefault.test 963ae9cdaed30a85a29668dd514e639f3556cae903ee9f172ea972
 F test/rowvaluevtab.test cd9747bb3f308086944c07968f547ad6b05022e698d80b9ffbdfe09ce0b8da6f
 F test/rtree.test 0c8d9dd458d6824e59683c19ab2ffa9ef946f798
 F test/run-wordcount.sh 891e89c4c2d16e629cd45951d4ed899ad12afc09
+F test/safemode.sql 8373efb03c49a9ceae81fa6d9216c69d7e8573351b273b3f82ae2c5ad9305f99
 F test/savepoint.test 6e9804a17767f08432c7a5e738b9a8f4b891d243110b63d3a41d270d3d1378ec
 F test/savepoint2.test 9b8543940572a2f01a18298c3135ad0c9f4f67d7
 F test/savepoint4.test c8f8159ade6d2acd9128be61e1230f1c1edc6cc0
@@ -1702,7 +1703,7 @@ F test/shared_err.test 32634e404a3317eeb94abc7a099c556a346fdb8fb3858dbe222a4cbb8
 F test/sharedlock.test 5ede3c37439067c43b0198f580fd374ebf15d304
 F test/shell-prompt.sql 8a320a78812d75349bd5e1a95178f7ff1f2194bb4cceee572865d127c51684b3
 F test/shell1.test 887cafc922795183241c929fe28a81a5276756fd751199e673d24f6231689914
-F test/shell2.test 1d7b9133b612d53f3c355dcba55845f84fcf2fe0d09459f82adbfaccae3c60b1
+F test/shell2.test eee473558d67c4a7cd9a0c974b4001ef1bf7977874111a6b5b1ef54564984173
 F test/shell3.test 91efdd545097a61a1f72cf79c9ad5b49da080f3f10282eaf4c3c272cd1012db2
 F test/shell4.test 931c7555d5a0dcac255561a936fcf1f54c12dd66f668e27e8b0d9ed0d4b9fe22
 F test/shell5.test a0c43d82a811a463a5d07d6418c5a045ab01a072544db8aa31ae394e93845d8d
@@ -1711,7 +1712,7 @@ F test/shell7.test 6b006d296b569a7ec78b8168af77578b3bde8f58b79c32d9f46cff1eaf763
 F test/shell8.test d2fc95f7467c3d93834cac3327bdac03554991afed6d9a07e6a2b204b037f9d7
 F test/shell9.test c0e8871061a92151450b3332279a893b516fa73a6c46d4f51a0998407cbf8c89
 F test/shellA.test 05cdaafa1f79913654487ce3aefa038d4106245d58f52e02faf506140a76d480
-F test/shellB.test 0de1535ff85d955fc6805964faa1f338539735f103e1af20c84b0e07b46830ee
+F test/shellB.test 4dd7b534c96eaf7db8a767d0d1ab3e515680ae1a76d3322a0196b4491814286a
 F test/shmlock.test 9f1f729a7fe2c46c88b156af819ac9b72c0714ac6f7246638a73c5752b5fd13c
 F test/shortread1.test bb591ef20f0fd9ed26d0d12e80eee6d7ac8897a3
 F test/show_speedtest1_rtree.tcl 32e6c5f073d7426148a6936a0408f4b5b169aba5
@@ -2282,8 +2283,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 6b286a1bb034fc7f855e023aa0dab920366d949dd5fefcf2652039d5c6dc96ed
-R 6832cc6f42700a3a0c3afc7347dc578f
+P 48fedacea79a9cd0a93d88dc38588ae0f1a011ed908b41ba4f2e2ee1160ffa44
+R b69c388ecea614509fd3051d8128a1c0
 U drh
-Z a0b6262ba8ff0a6b06a5c6dafe7c9fd3
+Z 94a59aa900bb0b17d93a535bc2901351
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index d0cecfa728..6135e7948b 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-48fedacea79a9cd0a93d88dc38588ae0f1a011ed908b41ba4f2e2ee1160ffa44
+e3e5ef4e17373677e1cc589ac79e20f6fb523e60fe8afdbc0b92f12cc75cff8b
diff --git a/src/shell.c.in b/src/shell.c.in
index fea27a3109..4f6dd4182d 100644
--- a/src/shell.c.in
+++ b/src/shell.c.in
@@ -5244,7 +5244,9 @@ static void open_db(ShellState *p, int openFlags){
     sqlite3_diskused_init(p->db, 0, 0);
     sqlite3_strdup_init(p->db, 0, 0);
 #ifndef SQLITE_SHELL_FIDDLE
-    sqlite3_fileio_init(p->db, 0, 0);
+    if( !p->bSafeMode ){
+      sqlite3_fileio_init(p->db, 0, 0);
+    }
     sqlite3_completion_init(p->db, 0, 0);
 #endif
 #ifdef SQLITE_HAVE_ZLIB
diff --git a/test/safemode.sql b/test/safemode.sql
new file mode 100644
index 0000000000..6432891fe0
--- /dev/null
+++ b/test/safemode.sql
@@ -0,0 +1,31 @@
+#!sqlite3
+#
+# 2026-10-10
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# Test cases that only work if the CLI is run in --safe mode.
+#
+#   ./sqlite3 --safe test/clierrors.sql
+#
+#
+.testcase 100
+.mode list --null NULL
+SELECT readfile('probe.txt');
+.check --glob <<END
+*no such function: readfile
+  SELECT readfile('probe.txt');
+         ^--- error here
+END
+
+# Bug 2026-10-10T13:15:05Z
+.testcase 110
+SELECT data FROM fsdir('probe.txt');
+.check --glob '*no such table: fsdir'
diff --git a/test/shell2.test b/test/shell2.test
index 9ddcafc949..6a1534de68 100644
--- a/test/shell2.test
+++ b/test/shell2.test
@@ -210,7 +210,9 @@ do_test shell2-1.4.8 {
 do_test shell2-1.4.9 {
   catchcmd "-safe :memory:" {
  SELECT writefile('DoNotCare', x'');}
-} {1 {line 2: cannot use the writefile() function in safe mode}}
+} {1 {Parse error near line 2: no such function: writefile
+  SELECT writefile('DoNotCare', x'');
+         ^--- error here}}
 
 # Verify that .clone handles sequence table.
 # See https://sqlite.org/forum/forumpost/71ff9e6c4c
diff --git a/test/shellB.test b/test/shellB.test
index ba3d08a14f..1481c862c6 100644
--- a/test/shellB.test
+++ b/test/shellB.test
@@ -25,7 +25,7 @@ set CLI [test_cli_invocation]
 proc do_clitest {name args} {
   set mapping [list <NAME> $::testdir/$name <CLI> $::CLI <ARGS> $args]
   set script [string map $mapping {
-    catch {exec <CLI> <ARGS> :memory: ".read <NAME>" 2>@stdout} res
+    catch {exec <CLI> <ARGS> :memory: <NAME> 2>@stdout} res
     set ntest 0
     set nerr 999
     regexp {(\d+) tests? run with (\d+) errors?} $res all ntest nerr
@@ -68,6 +68,12 @@ do_clitest imposter1.sql
 do_clitest sha1.sql
 do_clitest complete_sql.sql
 do_clitest clierrors.sql
+set probe $testdir/probe.txt
+forcedelete $probe
+set f [open $probe wb]
+puts -nonewline $f xyzzy
+close $f
+do_clitest safemode.sql --safe
 ifcapable vtab {
   do_clitest dotcmd01.sql
   do_clitest import01.sql