mirror of
https://gitee.com/samwaf/SamWaf.git
synced 2026-11-03 11:41:55 +08:00
samwaf
8e4286150d
- Replace raw SQL execution with a structured query (table/mode/columns/filters/top); backend no longer accepts any SQL string - Fail-closed table & column whitelist: block sensitive tables (auth/key/cert/config/plugin) and columns (password/secret/token/private/key) - Block EAV/key-value tables (value/params columns) to prevent plaintext secret leak, e.g. system_configs.value - Parameterize all filter values via GORM clause expressions; operator whitelist; cap filters/IN length - Add queryable-schema endpoint + query audit logging; harden GetTableInfo to skip sensitive tables/columns
18 lines
445 B
Go
18 lines
445 B
Go
package router
|
|
|
|
import (
|
|
"SamWaf/api"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type SqlQueryRouter struct {
|
|
}
|
|
|
|
func (receiver *SqlQueryRouter) InitSqlQueryRouter(group *gin.RouterGroup) {
|
|
api := api.APIGroupAPP.WafSqlQueryApi
|
|
router := group.Group("")
|
|
router.POST("/api/v1/sql_query/execute", api.ExecuteQueryApi)
|
|
router.GET("/api/v1/sql_query/table_info", api.GetTableInfoApi)
|
|
router.GET("/api/v1/sql_query/queryable", api.GetQueryableSchemaApi)
|
|
}
|