1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
use serde_json::Value;
use std::fmt::{Debug, Display};
use rbatis_core::Error;
use crate::core::convert::StmtConvert;
use crate::crud::CRUDTable;
use crate::rbatis::Rbatis;
use crate::DriverType;
pub trait SqlIntercept: Send + Sync + Debug {
fn name(&self) -> &str {
std::any::type_name::<Self>()
}
fn do_intercept(
&self,
rb: &Rbatis,
context_id: &str,
sql: &mut String,
args: &mut Vec<serde_json::Value>,
is_prepared_sql: bool,
) -> Result<(), crate::core::Error>;
}
#[derive(Debug)]
pub struct RbatisLogFormatSqlIntercept {}
impl SqlIntercept for RbatisLogFormatSqlIntercept {
fn do_intercept(&self, rb: &Rbatis, context_id: &str, sql: &mut String, args: &mut Vec<Value>, is_prepared_sql: bool) -> Result<(), Error> {
let driver_type = rb.driver_type()?;
match driver_type {
DriverType::None => {}
DriverType::Mysql | DriverType::Postgres | DriverType::Sqlite | DriverType::Mssql => {
let mut formated = format!("[format_sql]{}", sql);
for index in 0..args.len() {
formated = formated.replacen(&driver_type.stmt_convert(index), &format!("{}", args.get(index).unwrap()), 1);
}
rb.log_plugin.info(context_id, &formated);
}
}
return Ok(());
}
}
#[derive(Debug)]
pub struct BlockAttackDeleteInterceptor {}
impl SqlIntercept for BlockAttackDeleteInterceptor {
fn do_intercept(&self, rb: &Rbatis, context_id: &str, sql: &mut String, args: &mut Vec<Value>, is_prepared_sql: bool) -> Result<(), Error> {
let sql = sql.trim();
if sql.starts_with(crate::sql::TEMPLATE.delete_from.value) && !sql.contains(crate::sql::TEMPLATE.r#where.left_right_space) {
return Err(Error::from(format!("[rbatis][BlockAttackDeleteInterceptor] not allow attack sql:{}", sql)));
}
return Ok(());
}
}
#[derive(Debug)]
pub struct BlockAttackUpdateInterceptor {}
impl SqlIntercept for BlockAttackUpdateInterceptor {
fn do_intercept(&self, rb: &Rbatis, context_id: &str, sql: &mut String, args: &mut Vec<Value>, is_prepared_sql: bool) -> Result<(), Error> {
let sql = sql.trim();
if sql.starts_with(crate::sql::TEMPLATE.update.value) && !sql.contains(crate::sql::TEMPLATE.r#where.left_right_space) {
return Err(Error::from(format!("[rbatis][BlockAttackUpdateInterceptor] not allow attack sql:{}", sql)));
}
return Ok(());
}
}