sqlite: validate backup() source is a DatabaseSync

backup() only checked that the source argument was a BaseObject before
casting it to Database, so passing a Statement or Session caused a
type confusion. Check against the DatabaseSync constructor template
instead.

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>

Author: araujogui

src/env_properties.h

@@ -451,6 +451,7 @@
   V(socketaddress_constructor_template, v8::FunctionTemplate)                  \
   V(space_stats_template, v8::DictionaryTemplate)                              \
   V(sqlite_column_template, v8::DictionaryTemplate)                            \
+  V(sqlite_database_constructor_template, v8::FunctionTemplate)                \
   V(sqlite_limits_template, v8::ObjectTemplate)                                \
   V(sqlite_run_result_template, v8::DictionaryTemplate)                        \
   V(sqlite_statement_sync_constructor_template, v8::FunctionTemplate)          \

src/node_sqlite.cc

@@ -3208,9 +3208,11 @@ void Database::CreateSession(const FunctionCallbackInfo<Value>& args) {
 
 void Backup(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  if (args.Length() < 1 || !args[0]->IsObject()) {
-    THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
-                               "The \"sourceDb\" argument must be an object.");
+  if (!args[0]->IsObject() ||
+      !env->sqlite_database_constructor_template()->HasInstance(args[0])) {
+    THROW_ERR_INVALID_ARG_TYPE(
+        env->isolate(),
+        "The \"sourceDb\" argument must be a DatabaseSync instance.");
     return;
   }
 
@@ -5425,6 +5427,7 @@ static void Initialize(Local<Object> target,
       FIXED_ONE_BYTE_STRING(isolate, "node:sqlite");
   db_tmpl->InstanceTemplate()->Set(sqlite_type_symbol, database_sync_string);
 
+  env->set_sqlite_database_constructor_template(db_tmpl);
   SetConstructorFunction(context, target, "Database", db_tmpl);
   SetConstructorFunction(context,
                          target,

test/parallel/test-sqlite-backup.mjs

@@ -48,10 +48,26 @@ describe('backup()', () => {
       backup();
     }, {
       code: 'ERR_INVALID_ARG_TYPE',
-      message: 'The "sourceDb" argument must be an object.'
+      message: 'The "sourceDb" argument must be a DatabaseSync instance.'
     });
   });
 
+  test('throws if the source is not a DatabaseSync', (t) => {
+    const database = makeSourceDb();
+    for (const source of [
+      {},
+      database.prepare('SELECT 1'),
+      database.createSession(),
+    ]) {
+      t.assert.throws(() => {
+        backup(source, 'out.db');
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: 'The "sourceDb" argument must be a DatabaseSync instance.'
+      });
+    }
+  });
+
   test('throws if path is not a string, URL, or Buffer', (t) => {
     const database = makeSourceDb();