Documentation
¶
Overview ¶
internal/util/identifiers.go
internal/util/sql_parser.go
internal/util/sql_validator.go
Index ¶
- Variables
- func IsReadOnlySQL(sqlText string) bool
- func MaskDSN(dsn string) string
- func NormalizeValue(v interface{}) interface{}
- func QuoteIdent(name string) (string, error)
- func TruncateQuery(query string, maxLen int) string
- func ValidateSQL(sqlText string) error
- func ValidateSQLCombined(sqlText string) error
- func ValidateSQLWithParser(sqlText string) error
- func ValidateSelectColumns(selectStr string) (string, error)
- func ValidateWhereClause(where string) error
- type ParserValidationError
- type SQLValidationError
Constants ¶
This section is empty.
Variables ¶
var DangerousFunctions = map[string]bool{ "sleep": true, "benchmark": true, "get_lock": true, "release_lock": true, "is_free_lock": true, "is_used_lock": true, "release_all_locks": true, "load_file": true, "sys_eval": true, "sys_exec": true, }
DangerousFunctions lists MySQL functions that should be blocked even in SELECT statements.
var DangerousSchemas = map[string]bool{ "mysql": true, "information_schema": true, "performance_schema": true, "sys": true, }
DangerousSchemas lists schemas that should not be accessible.
Functions ¶
func IsReadOnlySQL ¶
IsReadOnlySQL is a convenience wrapper for ValidateSQL.
func MaskDSN ¶
MaskDSN hides password in DSN for display. DSN format: user:password@tcp(host:port)/database
func NormalizeValue ¶
func NormalizeValue(v interface{}) interface{}
NormalizeValue converts raw DB value into something JSON-friendly.
func QuoteIdent ¶
QuoteIdent safely quotes a MySQL identifier, returning an error if the name contains potentially dangerous characters.
func TruncateQuery ¶
TruncateQuery truncates a query string to maxLen characters.
func ValidateSQL ¶
ValidateSQL performs comprehensive SQL safety validation.
func ValidateSQLCombined ¶ added in v1.3.0
ValidateSQLCombined performs both parser-based and regex-based validation. This provides defense-in-depth: the parser catches structural issues, while regex catches edge cases the parser might miss.
func ValidateSQLWithParser ¶ added in v1.3.0
ValidateSQLWithParser performs SQL validation using a proper SQL parser. This is more robust than regex-based validation as it understands SQL syntax.
func ValidateSelectColumns ¶
ValidateSelectColumns validates and quotes column names in a SELECT list. Accepts: "col1, col2, col3" or "col1 AS alias, col2" Returns quoted column string or error if invalid.
func ValidateWhereClause ¶
ValidateWhereClause checks a WHERE clause for SQL injection attempts. This is a defense-in-depth measure - the primary protection is the read-only MySQL user, but we still block obvious injection patterns.
Types ¶
type ParserValidationError ¶ added in v1.3.0
ParserValidationError contains details about why a query was rejected by the parser.
func (*ParserValidationError) Error ¶ added in v1.3.0
func (e *ParserValidationError) Error() string
type SQLValidationError ¶
SQLValidationError contains details about why a query was rejected.
func (*SQLValidationError) Error ¶
func (e *SQLValidationError) Error() string
Source Files