51 lines
1.1 KiB
Go
51 lines
1.1 KiB
Go
package db
|
|
|
|
import "strings"
|
|
|
|
// IsDangerousSQL 识别可能破坏数据的语句，供前端二次确认。
|
|
func IsDangerousSQL(sql string) bool {
|
|
s := stripSQLLead(sql)
|
|
if s == "" {
|
|
return false
|
|
}
|
|
up := strings.ToUpper(s)
|
|
for _, p := range []string{"DROP ", "DROP\t", "TRUNCATE ", "ALTER ", "GRANT ", "REVOKE "} {
|
|
if strings.HasPrefix(up, strings.TrimSpace(p)) || strings.HasPrefix(up, p) {
|
|
return true
|
|
}
|
|
}
|
|
if strings.HasPrefix(up, "DELETE") {
|
|
return !containsWhere(up)
|
|
}
|
|
if strings.HasPrefix(up, "UPDATE") {
|
|
return !containsWhere(up)
|
|
}
|
|
return false
|
|
}
|
|
|
|
func containsWhere(up string) bool {
|
|
return strings.Contains(up, " WHERE ") || strings.Contains(up, "\nWHERE ") || strings.Contains(up, "\tWHERE ")
|
|
}
|
|
|
|
func stripSQLLead(sql string) string {
|
|
s := strings.TrimSpace(sql)
|
|
for {
|
|
if strings.HasPrefix(s, "--") {
|
|
if i := strings.IndexByte(s, '\n'); i >= 0 {
|
|
s = strings.TrimSpace(s[i+1:])
|
|
continue
|
|
}
|
|
return ""
|
|
}
|
|
if strings.HasPrefix(s, "/*") {
|
|
if i := strings.Index(s, "*/"); i >= 0 {
|
|
s = strings.TrimSpace(s[i+2:])
|
|
continue
|
|
}
|
|
return ""
|
|
}
|
|
break
|
|
}
|
|
return s
|
|
}
|