Project: StarRocks (App Definition and Development / Database)
File: Blacklist.md

displayed_sidebar: "English" In some cases, administrators need to disable certain patterns of SQL to avoid SQL from triggering cluster crashes or unexpected high concurrent queries. StarRocks allows users to add, view, and delete SQL blacklists. EnableSQL blacklisting via `enablesqlblacklist`. The default is False (off). ~~~sql admin set frontend config ("enablesqlblacklist" = "true") ~~~ The admin user who has ADMIN_PRIV privileges can manage blacklists by executing the following commands: ~~~sql ADD SQLBLACKLIST #sql# DELETE SQLBLACKLIST #sql# SHOW SQLBLACKLISTS ~~~ When `enablesqlblacklist` is true, every SQL query needs to be filtered by sqlblacklist. If it matches, the user will be informed that theSQL is in the blacklist. Otherwise, the SQL will be executed normally. The message may be as follows when the SQL is blacklisted: `ERROR 1064 (HY000): Access denied; sql 'select count (*) from testalltypeselect2556' is in blacklist` ~~~sql ADD SQLBLACKLIST #sql# ~~~ #sql# is a regular expression for a certain type of SQL. Since SQL itself contains the common characters `(`, `)`, `*`, `.` that may be mixed up with the semantics of regular expressions, so we need to distinguish those by using escape characters. Given that `(` and `)` are used too often in SQL, there is no need to use escape characters. Other special characters need to use the escape character `\` as a prefix. For example: Prohibit `count(\)`: ~~~sql ADD SQLBLACKLIST "select count(\\*) from .+" ~~~ Prohibit `count(distinct)`: ~~~sql ADD SQLBLACKLIST "select count(distinct .+) from .+" ~~~ Prohibit order by limit `x`, `y`, `1 <= x <=7`, `5 <=y <=7`: ~~~sql ADD SQLBLACKLIST "select idint from testalltypeselect1 order by id_int limit [1-7], [5-7]" ~~~ Prohibit complex SQL: ~~~sql ADD SQLBLACKLIST "select idint \\* 4, idtinyint, idvarchar from testalltypenullable except select idint, idtinyint, idvarchar from testbasic except select (idint \\* 9 \\- 8) \\/ 2, idtinyint, idvarchar from testalltypenullable2 except select idint, idtinyint, idvarchar from testbasic_nullable" ~~~ ~~~sql SHOW SQLBLACKLIST ~~~ Result format: `Index | Forbidden SQL` For example: ~~~sql mysql> show sqlblacklist; +-+--+ | Index | Forbidden SQL | +-+--+ | 1 | select count\(\*\) from .+ | | 2 | select idint \* 4, idtinyint, idvarchar from testalltypenullable except select idint, idtinyint, idvarchar from testbasic except select \(idint \* 9 \- 8\) \/ 2, idtinyint, idvarchar from testalltypenullable2 except select idint, idtinyint, idvarchar from testbasic_nullable | | 3 | select idint from testalltypeselect1 order by id_int limit [1-7], [5-7] | | 4 | select count\(distinct .+\) from .+ | +-+--+ ~~~ The SQL shown in `Forbidden SQL` is escaped for all SQL semantic characters. ~~~sql DELETE SQLBLACKLIST #indexlist# ~~~ For example, delete the sqlblacklist 3 and 4 in the above blacklist: ~~~sql delete sqlblacklist 3, 4; -- #indexlist# is a list of IDs separated by comma (,). ~~~ Then, the remaining sqlblacklist is as follows: ~~~sql mysql> show sqlblacklist; +-+--+ | Index | Forbidden SQL | +-+--+ | 1 | select count\(\*\) from .+ | | 2 | select idint \* 4, idtinyint, idvarchar from testalltypenullable except select idint, idtinyint, idvarchar from testbasic except select \(idint \* 9 \- 8\) \/ 2, idtinyint, idvarchar from testalltypenullable2 except select idint, idtinyint, idvarchar from testbasic_nullable | +-+--+ ~~~