Add patterns functionality to whitelist #231
Conversation
storojs72
changed the title
| if err != nil { | ||
| return false, ErrPatternSyntaxError | ||
| return false, ErrPatternCheckError |
There was a problem hiding this comment.
can we log the first error (err) before returning ErrPatternCheckError to know what actually happened?
| return matchDetected | ||
| } | ||
|
|
||
| // handle SELECT * FROM table %%WHERE%% pattern |
There was a problem hiding this comment.
better to format comment to godoc style // <methodName> some comment
| t.Fatal(err) | ||
| } | ||
| acceptableQueries := []string{ | ||
| "SELECT a, b, c FROM z WHERE a = 'someValue'", |
There was a problem hiding this comment.
can we test here queries that we use for star pattern too (https://github.com/cossacklabs/acra/blob/acracensor/acra-censor/acra-censor_test.go#L545) ? to test different where clauses without star and columns
| @@ -151,6 +151,9 @@ func handleSelectWherePattern(queryNodes, patternNodes []sqlparser.SQLNode) bool | |||
| patternWhereDetected := false | |||
| queryWhereDetected := false | |||
| for index, patternNode := range patternNodes { | |||
| if index >= len(queryNodes) { | |||
There was a problem hiding this comment.
maybe it makes sense to compare slice's lengths before loop?
if len(queryNodes) != len(patternNodes)
There was a problem hiding this comment.
Yes, actually we can perform this comparison before loop. But instead != it's better <, because length of query is allowed to be equal or greater than pattern. The intention here was to prevent case when pattern is greater than query, and index out of range when use queryNodes[index]
|
i noticed in many places in code and logs we use |
|
ahh, |
| if patternSelectExpr, ok := patternNodes[index+patternNodeOffset].(sqlparser.SelectExprs); ok && starFound(patternSelectExpr) { | ||
| if _, ok := queryNodes[index+queryNodeOffset].(sqlparser.SelectExprs); ok { | ||
| i := index | ||
| for i < len(queryNodes) { |
There was a problem hiding this comment.
for ;i<len(queryNodes); i++
| continue | ||
| } | ||
| if patternSelectExpr, ok := patternNodes[index+patternNodeOffset].(sqlparser.SelectExprs); ok && starFound(patternSelectExpr) { | ||
| if _, ok := queryNodes[index+queryNodeOffset].(sqlparser.SelectExprs); ok { |
No description provided.