sqlite: throw on invalid URL path instead of abort

ValidateDatabasePath() treats any object exposing a string `href` as a
URL, then asserts the parse result with CHECK(ada::can_parse(location)).
Whether that string parses depends on user input rather than on an
invariant the code guarantees, so a value such as { href: 'not a url' }
aborted the process instead of throwing.

Replace the CHECK with an ERR_INVALID_URL exception, matching how
node_file.cc reports an unparsable URL. Both DatabaseSync() and backup()
validate their path through this function, so both paths are covered.

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
Assisted-by: Claude Code
PR-URL: #66026
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: araujogui

src/node_sqlite.cc

@@ -1296,7 +1296,11 @@ std::optional<std::string> ValidateDatabasePath(Environment* env,
       Utf8Value location_value(env->isolate(), href.As<String>());
       auto location = location_value.ToStringView();
       if (!has_null_bytes(location)) {
-        CHECK(ada::can_parse(location));
+        if (!ada::can_parse(location)) {
+          THROW_ERR_INVALID_URL(env->isolate(), "Invalid URL");
+          return std::nullopt;
+        }
+
         if (!location.starts_with("file:")) {
           THROW_ERR_INVALID_URL_SCHEME(env->isolate());
           return std::nullopt;

test/parallel/test-sqlite-backup.mjs

@@ -269,6 +269,16 @@ test('throws if URL is not file: scheme', (t) => {
   });
 });
 
+test('throws if the URL-like path has an unparsable href', (t) => {
+  const database = new DatabaseSync(':memory:');
+
+  t.after(() => { database.close(); });
+
+  t.assert.throws(() => {
+    backup(database, { href: 'not a url' });
+  }, { code: 'ERR_INVALID_URL' });
+});
+
 test('database backup fails when dest file is not writable', { skip: isRoot }, async (t) => {
   const readonlyDestDb = nextDb();
   writeFileSync(readonlyDestDb, '', { mode: 0o444 });

test/parallel/test-sqlite-database-sync.js

@@ -51,6 +51,12 @@ suite('DatabaseSync() constructor', () => {
     });
   });
 
+  test('throws if the URL-like path has an unparsable href', (t) => {
+    t.assert.throws(() => {
+      new DatabaseSync({ href: 'not a url' });
+    }, { code: 'ERR_INVALID_URL' });
+  });
+
   test('throws if options is provided but is not an object', (t) => {
     t.assert.throws(() => {
       new DatabaseSync('foo', null);