瀏覽代碼

Merge branch 'feature/edb_python_forbidden' of eta_server/eta_index_lib into master

xyxie 1 年之前
父節點
當前提交
f462eae6bf
共有 1 個文件被更改,包括 7 次插入0 次删除
  1. 7 0
      services/base_from_python.go

+ 7 - 0
services/base_from_python.go

@@ -69,6 +69,13 @@ func ExecPythonCode(edbCode, reqCode string) (dataMap models.EdbDataFromPython,
 		}
 	}()
 
+	codeStr := strings.ToLower(reqCode)
+	// 限制python代码的执行,如果包含特殊的关键词,则报错
+	if strings.Contains(codeStr, "drop") || strings.Contains(codeStr, "delete") || strings.Contains(codeStr, "update") || strings.Contains(codeStr, "alter") || strings.Contains(codeStr, "truncate") {
+		err = fmt.Errorf("不支持该命令")
+		return
+	}
+
 	//获取python文件的绝对地址
 	pythonFile, err := getPythonFileAbsolutePath(edbCode)
 	if err != nil {