fix: 审核引擎优化 + 执行结果结构化展示
后端审核规则修复: - Redis SEC-001: SET/DEL等常规命令不再误报AUTH要求，改为仅对管理级命令WARNING - Redis SEC-003: 降级为INFO，排除已由CMD-001拦截的FLUSHDB/FLUSHALL - Redis key提取: 排除CONFIG/ACL等管理命令，不再把子命令参数误认为key名 - MySQL SEC-006: 新增GRANT ALL/REVOKE ALL全局权限拦截 - MySQL SEC-007: 新增LOAD DATA/LOAD XML拦截 - MySQL SEC-008: 新增SLEEP()/BENCHMARK()时间盲注拦截 - MySQL SEC-009: 新增INTO OUTFILE/DUMPFILE文件写入拦截 前端执行结果结构化: - TicketDetailPage执行结果从原始JSON改为结构化展示 - 解析JSON展示: 状态徽章+影响行数+耗时+验证状态 - Errors/Warnings逐条渲染: 红色错误框+黄色警告框+具体消息 - 删除废弃的executeStats/renderExecuteStats 其他: 审核规则6分组/慢查询移除/查询数据重命名/AuditLogs修复 测试: 1040 passed, TSC零错误
This commit is contained in:
logan committed
1 parent
9f56e866f2
commit
4ac2528f8e
19 files changed
+1202
-325
No files matched your search
@@ -0,0 +1,267 @@
|
||||
"""数据库类型说明 API — 人性化数据库能力查询。
|
||||
|
||||
提供每种数据库类型的详细信息，包括:
|
||||
- 支持的操作和限制
|
||||
- 查询语法示例
|
||||
- 安全规则说明
|
||||
- 推荐使用场景
|
||||
"""
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from typing import Dict, List, Any
|
||||
|
||||
from app.core.security import get_current_user
|
||||
from app.models.user import User
|
||||
|
||||
router = APIRouter(prefix="/db-types", tags=["数据库类型说明"])
|
||||
|
||||
|
||||
# ── 数据库类型元数据 ──
|
||||
|
||||
DB_TYPE_INFO: Dict[str, Dict[str, Any]] = {
|
||||
"mysql": {
|
||||
"name": "MySQL",
|
||||
"icon": "/db-logos/mysql.svg",
|
||||
"description": "最流行的开源关系型数据库，适合 Web 应用、OLTP 场景",
|
||||
"version": "5.7+ / 8.0+",
|
||||
"category": "关系型",
|
||||
"supported_query_types": [
|
||||
{"type": "SELECT", "description": "数据查询", "example": "SELECT id, name FROM users WHERE status = 'active' LIMIT 100"},
|
||||
{"type": "SHOW", "description": "元数据查询", "example": "SHOW TABLES; SHOW PROCESSLIST; SHOW VARIABLES LIKE 'slow%'"},
|
||||
{"type": "DESCRIBE", "description": "表结构查看", "example": "DESCRIBE users;"},
|
||||
{"type": "EXPLAIN", "description": "执行计划分析", "example": "EXPLAIN SELECT * FROM users WHERE id = 1"},
|
||||
],
|
||||
"security_rules": [
|
||||
"仅支持 SELECT / SHOW / DESCRIBE / EXPLAIN 只读查询",
|
||||
"禁止 DML (INSERT/UPDATE/DELETE) 和 DDL (CREATE/ALTER/DROP)",
|
||||
"查询结果自动脱敏敏感字段",
|
||||
"最大返回行数限制 (默认 1000 行)",
|
||||
],
|
||||
"tips": [
|
||||
"使用 EXPLAIN 分析慢查询",
|
||||
"避免 SELECT *，明确指定需要的列",
|
||||
"大数据量查询使用 LIMIT 分页",
|
||||
"利用索引提示 FORCE INDEX 优化查询",
|
||||
],
|
||||
"common_commands": {
|
||||
"查看所有表": "SHOW TABLES",
|
||||
"查看表结构": "DESCRIBE table_name",
|
||||
"查看建表语句": "SHOW CREATE TABLE table_name",
|
||||
"查看索引": "SHOW INDEX FROM table_name",
|
||||
"查看连接": "SHOW PROCESSLIST",
|
||||
"查看状态": "SHOW STATUS LIKE 'Threads%'",
|
||||
"查看慢查询": "SELECT * FROM mysql.slow_log ORDER BY start_time DESC LIMIT 20",
|
||||
},
|
||||
"limitations": [
|
||||
"不支持存储过程调用",
|
||||
"不支持临时表创建",
|
||||
"不支持 LOAD DATA INFILE",
|
||||
],
|
||||
},
|
||||
"postgres": {
|
||||
"name": "PostgreSQL",
|
||||
"icon": "/db-logos/postgres.svg",
|
||||
"description": "功能最强大的开源关系型数据库，适合复杂查询、GIS、JSON 场景",
|
||||
"version": "12+ / 13+ / 14+ / 15+",
|
||||
"category": "关系型",
|
||||
"supported_query_types": [
|
||||
{"type": "SELECT", "description": "数据查询", "example": "SELECT id, name FROM users WHERE status = 'active' LIMIT 100"},
|
||||
{"type": "EXPLAIN", "description": "执行计划分析", "example": "EXPLAIN ANALYZE SELECT * FROM users WHERE id = 1"},
|
||||
],
|
||||
"security_rules": [
|
||||
"仅支持 SELECT 只读查询",
|
||||
"支持 EXPLAIN / EXPLAIN ANALYZE (只读)",
|
||||
"禁止 DML (INSERT/UPDATE/DELETE) 和 DDL 操作",
|
||||
"查询结果自动脱敏",
|
||||
],
|
||||
"tips": [
|
||||
"使用 EXPLAIN ANALYZE 获取真实执行统计",
|
||||
"利用 CTE (WITH 语句) 优化复杂查询",
|
||||
"pg_stat_user_tables 查看表统计信息",
|
||||
"使用 JSONB 类型和操作符处理 JSON 数据",
|
||||
],
|
||||
"common_commands": {
|
||||
"查看所有表": "SELECT tablename FROM pg_tables WHERE schemaname = 'public'",
|
||||
"查看表大小": "SELECT pg_size_pretty(pg_total_relation_size('table_name'))",
|
||||
"查看活动查询": "SELECT * FROM pg_stat_activity WHERE state = 'active'",
|
||||
"查看索引使用": "SELECT * FROM pg_stat_user_indexes ORDER BY idx_scan DESC",
|
||||
"查看锁等待": "SELECT * FROM pg_locks WHERE NOT granted",
|
||||
"查看表统计": "SELECT * FROM pg_stat_user_tables ORDER BY n_live_tup DESC",
|
||||
},
|
||||
"limitations": [
|
||||
"不支持存储过程调用",
|
||||
"不支持 COPY 命令",
|
||||
"不支持事务控制 (BEGIN/COMMIT)",
|
||||
],
|
||||
},
|
||||
"redis": {
|
||||
"name": "Redis",
|
||||
"icon": "/db-logos/redis.svg",
|
||||
"description": "高性能内存键值数据库，适合缓存、会话管理、排行榜场景",
|
||||
"version": "6.0+ / 7.0+",
|
||||
"category": "键值型",
|
||||
"supported_query_types": [
|
||||
{"type": "GET", "description": "获取字符串值", "example": "GET user:1001"},
|
||||
{"type": "HGETALL", "description": "获取哈希所有字段", "example": "HGETALL user:1001"},
|
||||
{"type": "LRANGE", "description": "获取列表范围", "example": "LRANGE mylist 0 -1"},
|
||||
{"type": "SMEMBERS", "description": "获取集合所有成员", "example": "SMEMBERS myset"},
|
||||
{"type": "ZRANGE", "description": "获取有序集合范围", "example": "ZRANGE leaderboard 0 10 WITHSCORES"},
|
||||
{"type": "INFO", "description": "服务器信息", "example": "INFO server; INFO memory"},
|
||||
{"type": "SCAN", "description": "迭代键", "example": "SCAN 0 MATCH user:* COUNT 50"},
|
||||
],
|
||||
"security_rules": [
|
||||
"仅支持只读命令白名单 (40+ 命令)",
|
||||
"禁止写入命令 (SET/DEL/FLUSHDB 等)",
|
||||
"禁止管理命令 (SHUTDOWN/DEBUG 等)",
|
||||
"KEYS 命令建议用 SCAN 替代 (生产环境安全)",
|
||||
],
|
||||
"tips": [
|
||||
"使用 SCAN 代替 KEYS 避免阻塞",
|
||||
"HGETALL 获取完整哈希，HGET 获取单个字段",
|
||||
"ZRANGE WITHSCORES 获取分数",
|
||||
"TYPE key 查看键的数据类型",
|
||||
"TTL key 查看剩余过期时间",
|
||||
],
|
||||
"common_commands": {
|
||||
"查看键数量": "DBSIZE",
|
||||
"查看服务器信息": "INFO server",
|
||||
"查看内存使用": "INFO memory",
|
||||
"查看键类型": "TYPE key_name",
|
||||
"扫描键": "SCAN 0 MATCH pattern COUNT 50",
|
||||
"获取字符串": "GET key_name",
|
||||
"获取哈希": "HGETALL key_name",
|
||||
"查看客户端": "CLIENT LIST",
|
||||
},
|
||||
"limitations": [
|
||||
"不支持 Lua 脚本执行 (EVAL)",
|
||||
"不支持事务 (MULTI/EXEC)",
|
||||
"SCAN 命令不支持跨数据库",
|
||||
],
|
||||
},
|
||||
"mongo": {
|
||||
"name": "MongoDB",
|
||||
"icon": "/db-logos/mongo.svg",
|
||||
"description": "文档型 NoSQL 数据库，适合灵活 Schema、JSON 原生存储场景",
|
||||
"version": "4.4+ / 5.0+ / 6.0+",
|
||||
"category": "文档型",
|
||||
"supported_query_types": [
|
||||
{"type": "find", "description": "查询文档", "example": "db.users.find({status: 'active'}).limit(100)"},
|
||||
{"type": "aggregate", "description": "聚合管道", "example": "db.orders.aggregate([{$match: {status: 'completed'}}, {$group: {_id: '$product', total: {$sum: '$amount'}}}])"},
|
||||
{"type": "countDocuments", "description": "计数", "example": "db.users.countDocuments({status: 'active'})"},
|
||||
{"type": "distinct", "description": "去重值", "example": "db.users.distinct('department')"},
|
||||
],
|
||||
"security_rules": [
|
||||
"仅支持 find/aggregate/countDocuments/distinct 只读操作",
|
||||
"聚合管道禁止 $out 和 $merge (防止写入)",
|
||||
"禁止 insert/update/delete/drop 等写操作",
|
||||
"查询结果限制最大返回数量",
|
||||
],
|
||||
"tips": [
|
||||
"使用投影 (projection) 只返回需要的字段",
|
||||
"aggregate 支持多阶段管道处理",
|
||||
"$lookup 实现类似 SQL JOIN 的关联查询",
|
||||
"createIndex / getIndexes 查看索引信息",
|
||||
],
|
||||
"common_commands": {
|
||||
"查看集合": "show collections",
|
||||
"查找文档": "db.collection.find({}).limit(20)",
|
||||
"计数文档": "db.collection.countDocuments({})",
|
||||
"聚合统计": "db.collection.aggregate([{$group: {_id: '$field', count: {$sum: 1}}}])",
|
||||
"查看索引": "db.collection.getIndexes()",
|
||||
"查看统计": "db.collection.stats()",
|
||||
},
|
||||
"limitations": [
|
||||
"聚合管道不支持 $out/$merge",
|
||||
"不支持 eval 命令",
|
||||
"不支持创建/删除集合",
|
||||
],
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@router.get("")
|
||||
async def list_db_types(
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""获取所有支持的数据库类型概览。
|
||||
|
||||
返回每种数据库类型的基本信息，包括名称、图标、描述和类别。
|
||||
用于前端展示数据库类型选择器或帮助信息。
|
||||
"""
|
||||
result = []
|
||||
for db_type, info in DB_TYPE_INFO.items():
|
||||
result.append({
|
||||
"type": db_type,
|
||||
"name": info["name"],
|
||||
"icon": info["icon"],
|
||||
"description": info["description"],
|
||||
"category": info["category"],
|
||||
"version": info["version"],
|
||||
"supported_operations": len(info["supported_query_types"]),
|
||||
"security_rules_count": len(info["security_rules"]),
|
||||
})
|
||||
return {"items": result, "total": len(result)}
|
||||
|
||||
|
||||
@router.get("/{db_type}")
|
||||
async def get_db_type_detail(
|
||||
db_type: str,
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""获取指定数据库类型的详细信息。
|
||||
|
||||
包含: 支持的操作、查询语法示例、安全规则、使用技巧、常用命令。
|
||||
用于查询页面的上下文帮助和语法提示。
|
||||
"""
|
||||
if db_type not in DB_TYPE_INFO:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="不支持的数据库类型: " + db_type + "。支持: mysql, postgres, redis, mongo",
|
||||
)
|
||||
|
||||
info = DB_TYPE_INFO[db_type]
|
||||
return {
|
||||
"type": db_type,
|
||||
**info,
|
||||
}
|
||||
|
||||
|
||||
@router.get("/{db_type}/commands")
|
||||
async def get_db_type_commands(
|
||||
db_type: str,
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""获取指定数据库类型的常用命令列表。
|
||||
|
||||
返回常用命令名称和示例，用于快捷查询模板。
|
||||
"""
|
||||
if db_type not in DB_TYPE_INFO:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="不支持的数据库类型: " + db_type,
|
||||
)
|
||||
|
||||
commands = DB_TYPE_INFO[db_type]["common_commands"]
|
||||
result = [
|
||||
{"name": name, "command": cmd}
|
||||
for name, cmd in commands.items()
|
||||
]
|
||||
return {"items": result, "total": len(result)}
|
||||
|
||||
|
||||
@router.get("/{db_type}/tips")
|
||||
async def get_db_type_tips(
|
||||
db_type: str,
|
||||
current_user: User = Depends(get_current_user),
|
||||
):
|
||||
"""获取指定数据库类型的使用技巧。
|
||||
|
||||
用于前端展示小贴士，帮助用户更好地使用查询功能。
|
||||
"""
|
||||
if db_type not in DB_TYPE_INFO:
|
||||
raise HTTPException(
|
||||
status_code=404,
|
||||
detail="不支持的数据库类型: " + db_type,
|
||||
)
|
||||
|
||||
tips = DB_TYPE_INFO[db_type]["tips"]
|
||||
return {"items": tips, "total": len(tips)}
|
||||
Reference in new issue
Block a user