mirror of
https://gitee.com/samwaf/SamWaf.git
synced 2026-09-01 15:32:55 +08:00
8e4286150d
- Replace raw SQL execution with a structured query (table/mode/columns/filters/top); backend no longer accepts any SQL string - Fail-closed table & column whitelist: block sensitive tables (auth/key/cert/config/plugin) and columns (password/secret/token/private/key) - Block EAV/key-value tables (value/params columns) to prevent plaintext secret leak, e.g. system_configs.value - Parameterize all filter values via GORM clause expressions; operator whitelist; cap filters/IN length - Add queryable-schema endpoint + query audit logging; harden GetTableInfo to skip sensitive tables/columns
21 lines
642 B
Go
21 lines
642 B
Go
package response
|
|
|
|
// QueryableColumn 可查询列(已剔除敏感列)。
|
|
type QueryableColumn struct {
|
|
Name string `json:"name"`
|
|
Type string `json:"type"`
|
|
}
|
|
|
|
// QueryableTable 可查询表及其可见列。
|
|
type QueryableTable struct {
|
|
TableName string `json:"table_name"`
|
|
Columns []QueryableColumn `json:"columns"`
|
|
}
|
|
|
|
// WafSqlQueryableResp 「取可查表/列」接口响应,仅供前端向导下拉使用:
|
|
// 不含敏感表、不含敏感列,也不返回行数/索引等额外结构信息。
|
|
type WafSqlQueryableResp struct {
|
|
DbType string `json:"db_type"`
|
|
Tables []QueryableTable `json:"tables"`
|
|
}
|