Files
SamWaf/model/response/waf_sql_queryable_resp.go
T
samwaf 8e4286150d fix(security): structured whitelist for SQL query API (remove raw SQL)
- Replace raw SQL execution with a structured query (table/mode/columns/filters/top); backend no longer accepts any SQL string
- Fail-closed table & column whitelist: block sensitive tables (auth/key/cert/config/plugin) and columns (password/secret/token/private/key)
- Block EAV/key-value tables (value/params columns) to prevent plaintext secret leak, e.g. system_configs.value
- Parameterize all filter values via GORM clause expressions; operator whitelist; cap filters/IN length
- Add queryable-schema endpoint + query audit logging; harden GetTableInfo to skip sensitive tables/columns
2026-07-03 16:30:53 +08:00

21 lines
642 B
Go

package response
// QueryableColumn 可查询列(已剔除敏感列)。
type QueryableColumn struct {
Name string `json:"name"`
Type string `json:"type"`
}
// QueryableTable 可查询表及其可见列。
type QueryableTable struct {
TableName string `json:"table_name"`
Columns []QueryableColumn `json:"columns"`
}
// WafSqlQueryableResp 「取可查表/列」接口响应,仅供前端向导下拉使用:
// 不含敏感表、不含敏感列,也不返回行数/索引等额外结构信息。
type WafSqlQueryableResp struct {
DbType string `json:"db_type"`
Tables []QueryableTable `json:"tables"`
}