package db

import "strings"

// IsDangerousSQL 识别可能破坏数据的语句，供前端二次确认。
func IsDangerousSQL(sql string) bool {
	s := stripSQLLead(sql)
	if s == "" {
		return false
	}
	up := strings.ToUpper(s)
	for _, p := range []string{"DROP ", "DROP\t", "TRUNCATE ", "ALTER ", "GRANT ", "REVOKE "} {
		if strings.HasPrefix(up, strings.TrimSpace(p)) || strings.HasPrefix(up, p) {
			return true
		}
	}
	if strings.HasPrefix(up, "DELETE") {
		return !containsWhere(up)
	}
	if strings.HasPrefix(up, "UPDATE") {
		return !containsWhere(up)
	}
	return false
}

func containsWhere(up string) bool {
	return strings.Contains(up, " WHERE ") || strings.Contains(up, "\nWHERE ") || strings.Contains(up, "\tWHERE ")
}

func stripSQLLead(sql string) string {
	s := strings.TrimSpace(sql)
	for {
		if strings.HasPrefix(s, "--") {
			if i := strings.IndexByte(s, '\n'); i >= 0 {
				s = strings.TrimSpace(s[i+1:])
				continue
			}
			return ""
		}
		if strings.HasPrefix(s, "/*") {
			if i := strings.Index(s, "*/"); i >= 0 {
				s = strings.TrimSpace(s[i+2:])
				continue
			}
			return ""
		}
		break
	}
	return s
}