77 lines
3.3 KiB
Go
77 lines
3.3 KiB
Go
package db
|
|
|
|
import "testing"
|
|
|
|
// 危险语句命中/放行矩阵,含四类历史绕过:多语句、/*! */ 可执行注释、
|
|
// 注释吞掉 WHERE、WITH CTE 包裹写操作。
|
|
func TestCheckDangerousSQLMatrix(t *testing.T) {
|
|
dangerous := []string{
|
|
"DROP TABLE users",
|
|
"drop table users", // 大小写
|
|
"TRUNCATE TABLE t", // TRUNCATE
|
|
"ALTER TABLE t ADD COLUMN c int", // ALTER(误报方向维持现状)
|
|
"GRANT ALL ON *.* TO 'u'", // GRANT
|
|
"REVOKE ALL ON *.* FROM 'u'", // REVOKE
|
|
"CREATE USER 'u'@'%' IDENTIFIED BY 'p'", // CREATE USER
|
|
"CREATE ROLE app", // CREATE ROLE
|
|
"RENAME TABLE a TO b", // RENAME TABLE
|
|
"REPLACE INTO t VALUES (1)", // REPLACE INTO
|
|
"LOAD DATA INFILE '/tmp/x' INTO TABLE t", // LOAD DATA
|
|
"SELECT * INTO OUTFILE '/tmp/x' FROM t", // INTO OUTFILE
|
|
"SELECT * INTO DUMPFILE '/tmp/x' FROM t", // INTO DUMPFILE
|
|
"EXEC xp_cmdshell 'dir'", // xp_cmdshell
|
|
"EXEC sp_configure 'x'", // EXEC 开头
|
|
"CALL do_thing()", // CALL 开头
|
|
"COPY t FROM PROGRAM 'cmd'", // COPY FROM PROGRAM
|
|
"DELETE FROM users", // DELETE 无 WHERE
|
|
"UPDATE users SET x=1", // UPDATE 无 WHERE
|
|
"SELECT 1; DROP TABLE t", // 多语句绕过
|
|
"/*!50000 DROP TABLE t*/", // MySQL 可执行注释
|
|
"SELECT 1; /*!40101 SET @x = 1*/; DROP TABLE t", // 可执行注释 + 多语句
|
|
"UPDATE t SET x=1 -- WHERE id=2", // 注释吞掉 WHERE
|
|
"UPDATE t SET x=1 # WHERE id=2", // # 注释吞掉 WHERE
|
|
"UPDATE t SET x=1 /* WHERE id=2 */", // 块注释吞掉 WHERE
|
|
"WITH x AS (SELECT 1) DELETE FROM t", // CTE 包裹 DELETE 无 WHERE
|
|
"WITH x AS (SELECT 1) UPDATE t SET a=1", // CTE 包裹 UPDATE 无 WHERE
|
|
}
|
|
for _, sql := range dangerous {
|
|
if hits := CheckDangerousSQL("mysql", sql); len(hits) == 0 {
|
|
t.Errorf("应命中但未命中: %q", sql)
|
|
}
|
|
}
|
|
|
|
safe := []string{
|
|
"SELECT * FROM users",
|
|
"SELECT * FROM users WHERE id = 1",
|
|
"DELETE FROM users WHERE id = 1",
|
|
"UPDATE users SET x = 1 WHERE id = 2",
|
|
"UPDATE users SET x = 1\nWHERE id = 2",
|
|
"INSERT INTO t VALUES (1)",
|
|
"CREATE TABLE t (id int)",
|
|
"SELECT 'DROP TABLE x'", // 字符串内关键字
|
|
"SELECT * FROM t WHERE note = 'truncate it'", // 字符串内关键字
|
|
"-- DROP TABLE t\nSELECT 1", // 注释内关键字
|
|
"SELECT * FROM t /* DROP TABLE x */ WHERE 1=1", // 块注释内关键字
|
|
"SELECT * FROM updated WHERE id = 1", // 词边界:updated 不算 UPDATE
|
|
"SELECT 1; SELECT 2",
|
|
"WITH x AS (SELECT 1) SELECT * FROM x",
|
|
"SHOW TABLES",
|
|
"EXPLAIN SELECT 1",
|
|
}
|
|
for _, sql := range safe {
|
|
if hits := CheckDangerousSQL("mysql", sql); len(hits) > 0 {
|
|
t.Errorf("误报: %q → %v", sql, hits)
|
|
}
|
|
}
|
|
}
|
|
|
|
// 旧接口兼容:IsDangerousSQL 委托 CheckDangerousSQL。
|
|
func TestIsDangerousSQLCompat(t *testing.T) {
|
|
if !IsDangerousSQL("DROP TABLE users") {
|
|
t.Fatal("drop")
|
|
}
|
|
if IsDangerousSQL("SELECT * FROM users") {
|
|
t.Fatal("select")
|
|
}
|
|
}
|