lhq/FT546-WCS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(shadow): allow SQL Server encryption metadata permissions

Browse Source
This commit is contained in:
zgw
2026-08-28 09:58:58 +08:00
parent 01bdf37b06
commit 8d78f8563c
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/startup/SqlServerPermissionProbe.java
View File

@@ -43,6 +43,10 @@ public class SqlServerPermissionProbe {
"db_ddladmin", "db_securityadmin", "db_accessadmin"); "db_ddladmin", "db_securityadmin", "db_accessadmin");
private static final List<String> EVIDENCE_TABLE_PERMISSIONS = private static final List<String> EVIDENCE_TABLE_PERMISSIONS =
Arrays.asList("SELECT", "INSERT", "UPDATE", "DELETE"); Arrays.asList("SELECT", "INSERT", "UPDATE", "DELETE");
private static final List<String> EVIDENCE_METADATA_PERMISSIONS =
Arrays.asList("CONNECT",
"VIEW ANY COLUMN ENCRYPTION KEY DEFINITION",
"VIEW ANY COLUMN MASTER KEY DEFINITION");
private static final String DATABASE_ROLE_MEMBERSHIP_SQL = private static final String DATABASE_ROLE_MEMBERSHIP_SQL =
"SELECT role_principal.name AS role_name " "SELECT role_principal.name AS role_name "
+ "FROM sys.database_role_members rm " + "FROM sys.database_role_members rm "
@@ -253,7 +257,7 @@ public class SqlServerPermissionProbe {
"SELECT permission_name FROM fn_my_permissions(NULL, 'DATABASE')")) { "SELECT permission_name FROM fn_my_permissions(NULL, 'DATABASE')")) {
while (permissions.next()) { while (permissions.next()) {
String permission = permissions.getString("permission_name"); String permission = permissions.getString("permission_name");
if (!"CONNECT".equalsIgnoreCase(permission)) { if (!isAllowedEvidenceDatabasePermission(permission)) {
return PermissionCheckResult.rejected( return PermissionCheckResult.rejected(
"EVIDENCE_HAS_EFFECTIVE_" + reason(permission) "EVIDENCE_HAS_EFFECTIVE_" + reason(permission)
+ "_DATABASE_PERMISSION"); + "_DATABASE_PERMISSION");
@@ -297,6 +301,12 @@ public class SqlServerPermissionProbe {
"EVIDENCE_DATABASE_VERIFIED"); "EVIDENCE_DATABASE_VERIFIED");
} }
private static boolean isAllowedEvidenceDatabasePermission(
String permission) {
return permission != null && EVIDENCE_METADATA_PERMISSIONS.contains(
permission.trim().toUpperCase(Locale.ROOT));
}
private static String sourcePermissionSql() { private static String sourcePermissionSql() {
StringBuilder sql = new StringBuilder("SELECT "); StringBuilder sql = new StringBuilder("SELECT ");
Set<String> expressions = new LinkedHashSet<String>(); Set<String> expressions = new LinkedHashSet<String>();