41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
id: 1c-readonly-query-policy
|
|
status: active
|
|
default_mode: deny
|
|
allowed:
|
|
- select
|
|
limits:
|
|
max_rows: 1000
|
|
default_rows: 100
|
|
timeout_seconds: 30
|
|
max_timeout_seconds: 120
|
|
deny_patterns:
|
|
- "(?i)\\bВЫБРАТЬ\\s+РАЗРЕШЕННЫЕ\\b.*\\bПОМЕСТИТЬ\\b"
|
|
- "(?i)\\bПОМЕСТИТЬ\\b"
|
|
- "(?i)\\bУНИЧТОЖИТЬ\\b"
|
|
- "(?i)\\bОБНОВИТЬ\\b"
|
|
- "(?i)\\bВСТАВИТЬ\\b"
|
|
- "(?i)\\bУДАЛИТЬ\\b"
|
|
- "(?i)\\bALTER\\b"
|
|
- "(?i)\\bDROP\\b"
|
|
- "(?i)\\bUPDATE\\b"
|
|
- "(?i)\\bINSERT\\b"
|
|
- "(?i)\\bDELETE\\b"
|
|
- "(?i)\\bCREATE\\s+(LOGIN|USER|ROLE)\\b"
|
|
- "(?i)\\bALTER\\s+(LOGIN|USER|ROLE)\\b"
|
|
- "(?i)\\bDROP\\s+(LOGIN|USER|ROLE)\\b"
|
|
- "(?i)\\b(GRANT|DENY|REVOKE)\\b"
|
|
masking:
|
|
enabled: true
|
|
fields:
|
|
- "(?i).*пароль.*"
|
|
- "(?i).*телефон.*"
|
|
- "(?i).*email.*"
|
|
- "(?i).*почта.*"
|
|
- "(?i).*паспорт.*"
|
|
- "(?i).*инн.*"
|
|
audit:
|
|
log_queries: true
|
|
log_params: false
|
|
log_result_rows: false
|
|
notes: "Read-only query runner policy. Connection identity comes only from the explicit base_id settings. Validate before execution and apply row limits/masking."
|