samwaf 8e4286150d fix(security): structured whitelist for SQL query API (remove raw SQL) ...

- Replace raw SQL execution with a structured query (table/mode/columns/filters/top); backend no longer accepts any SQL string
- Fail-closed table & column whitelist: block sensitive tables (auth/key/cert/config/plugin) and columns (password/secret/token/private/key)
- Block EAV/key-value tables (value/params columns) to prevent plaintext secret leak, e.g. system_configs.value
- Parameterize all filter values via GORM clause expressions; operator whitelist; cap filters/IN length
- Add queryable-schema endpoint + query audit logging; harden GetTableInfo to skip sensitive tables/columns

2026-07-03 16:30:53 +08:00

..

baseorm

feat:add mysql

2026-05-12 17:00:04 +08:00

common

fix(security): bcrypt password hashing + server-side forced password change

2026-07-03 14:47:59 +08:00

detection

…

request

fix(security): structured whitelist for SQL query API (remove raw SQL)

2026-07-03 16:30:53 +08:00

response

fix(security): structured whitelist for SQL query API (remove raw SQL)

2026-07-03 16:30:53 +08:00

spec

…

wafappmodel

feat:add application management

2026-06-08 16:08:54 +08:00

wafenginmodel

feat:web page anti-tamper protection

2026-07-01 13:47:32 +08:00

waftunnelmodel

…

account_pwd_history.go

feat:add account rbac

2026-06-29 14:05:09 +08:00

account.go

fix(security): bcrypt password hashing + server-side forced password change

2026-07-03 14:47:59 +08:00

allowlist.go

feat:add mysql

2026-05-12 17:00:04 +08:00

anticc.go

feat:add mysql

2026-05-12 17:00:04 +08:00

batchtask.go

feat:add mysql

2026-05-12 17:00:04 +08:00

blocking_page.go

feat:add mysql

2026-05-12 17:00:04 +08:00

blocklist.go

feat:add mysql

2026-05-12 17:00:04 +08:00

ca_server_info.go

feat:add mysql

2026-05-12 17:00:04 +08:00

cache_rule.go

feat:add mysql

2026-05-12 17:00:04 +08:00

center.go

feat:add mysql

2026-05-12 17:00:04 +08:00

data_retention_policy.go

feat:add mysql

2026-05-12 17:00:04 +08:00

delaymsg.go

feat:add mysql

2026-05-12 17:00:04 +08:00

firewall_ip_block.go

feat:add mysql

2026-05-12 17:00:04 +08:00

gpt.go

…

host_path_rule.go

feat:path rule backend protocol, access log switch and response timeout

2026-07-02 15:59:11 +08:00

hosts.go

feat:file upload detection config

2026-07-02 11:31:43 +08:00

http_auth_base_config.go

feat:add mysql

2026-05-12 17:00:04 +08:00

IPTag.go

feat:add mysql

2026-05-12 17:00:04 +08:00

ldp.go

feat:add mysql

2026-05-12 17:00:04 +08:00

loadbalance.go

feat:add mysql

2026-05-12 17:00:04 +08:00

msgpacket.go

…

notify_channel.go

feat:add mysql

2026-05-12 17:00:04 +08:00

notify_log.go

feat:add mysql

2026-05-12 17:00:04 +08:00

notify_subscription.go

feat:add mysql

2026-05-12 17:00:04 +08:00

onekeymod.go

feat:add mysql

2026-05-12 17:00:04 +08:00

oplatform_key.go

feat:add mysql

2026-05-12 17:00:04 +08:00

oplatform_log.go

feat:add mysql

2026-05-12 17:00:04 +08:00

otp.go

feat:add mysql

2026-05-12 17:00:04 +08:00

private_group.go

feat:add mysql

2026-05-12 17:00:04 +08:00

private_info.go

feat:add mysql

2026-05-12 17:00:04 +08:00

reginfo.go

…

rule_info_json.go

…

rules.go

feat:add mysql

2026-05-12 17:00:04 +08:00

sensitive.go

feat:add mysql

2026-05-12 17:00:04 +08:00

sharedb.go

feat:add mysql

2026-05-12 17:00:04 +08:00

sslconfig.go

fix:mysql field

2026-07-02 13:59:35 +08:00

sslexpire.go

fix:mysql field

2026-07-02 13:59:35 +08:00

sslorder.go

fix:mysql field

2026-07-02 13:59:35 +08:00

stats.go

feat:add mysql

2026-05-12 17:00:04 +08:00

sys_info.go

…

system_config.go

feat:add mysql

2026-05-12 17:00:04 +08:00

tamper_rule.go

feat:web page anti-tamper protection

2026-07-01 13:47:32 +08:00

task.go

feat:add mysql

2026-05-12 17:00:04 +08:00

tunnel.go

feat:add mysql

2026-05-12 17:00:04 +08:00

update_version.go

…

waf_app_change_log.go

feat:strengthen the safety operation of the application management

2026-06-09 17:31:53 +08:00

waf_app.go

feat:add application management

2026-06-08 16:08:54 +08:00

waf_attack_log.go

…

waf_log_label_mark.go

feat:add light ai model

2026-06-15 17:00:35 +08:00

waf_plugin_config.go

…

waf_sys.go

feat:add mysql

2026-05-12 17:00:04 +08:00