test prepared statements with acra-censor

acra-censor/acra-censor_implementation.go

@@ -64,13 +64,21 @@ func (acraCensor *AcraCensor) ReleaseAll() {
 
 // HandleQuery processes every query through each handler.
 func (acraCensor *AcraCensor) HandleQuery(query string) error {
+	if query == "" {
+		return nil
+	}
 	if len(acraCensor.handlers) == 0 {
 		// no handlers, AcraCensor won't work
 		return nil
 	}
 	normalizedQuery, queryWithHiddenValues, err := handlers.NormalizeAndRedactSQLQuery(query)
 	if err == handlers.ErrQuerySyntaxError && acraCensor.ignoreParseError {
 		acraCensor.logger.WithError(err).Infof("Parsing error on query (first %v symbols): %s", handlers.LogQueryLength, handlers.TrimStringToN(queryWithHiddenValues, handlers.LogQueryLength))
+
+	}
+	if err != nil {
+		// ignore parsing errors to forward it as is to acra-censor to allow filter it via QueryIgnore handler
+		normalizedQuery = query
 	}
 	for _, handler := range acraCensor.handlers {
 		// in QueryCapture Handler use only redacted queries

acra-censor/handlers/blacklist_handler.go

@@ -55,7 +55,7 @@ func (handler *BlacklistHandler) CheckQuery(query string) (bool, error) {
 	if len(handler.tables) != 0 {
 		parsedQuery, err := sqlparser.Parse(query)
 		if err != nil {
-			handler.logger.WithField(logging.FieldKeyEventCode, logging.EventCodeErrorCensorQueryParseError).WithError(ErrQuerySyntaxError).Errorln("Query has been blocked by blacklist [tables]. Parsing error")
+			handler.logger.WithField(logging.FieldKeyEventCode, logging.EventCodeErrorCensorQueryParseError).WithError(err).Errorln("Query has been blocked by blacklist [tables]. Parsing error")
 			return false, ErrQuerySyntaxError
 		}
 		switch parsedQuery := parsedQuery.(type) {

acra-censor/handlers/queryignore_handler.go

@@ -16,6 +16,8 @@ limitations under the License.
 
 package handlers
 
+import "github.com/sirupsen/logrus"
+
 // QueryIgnoreHandler allows to ignore any query
 type QueryIgnoreHandler struct {
 	ignoredQueries map[string]bool
@@ -52,6 +54,9 @@ func (handler *QueryIgnoreHandler) AddQueries(queries []string) {
 	for _, query := range queries {
 		normalizedQuery, _, err := NormalizeAndRedactSQLQuery(query)
 		if err != nil {
+			logrus.WithError(err).Warningln("Can't add query to QueryIgnoreHandler in normalized form, added as is")
+			// add as is
+			handler.ignoredQueries[query] = true
 			continue
 		}
 		handler.ignoredQueries[normalizedQuery] = true

acra-censor/handlers/whitelist_handler.go

@@ -55,7 +55,7 @@ func (handler *WhitelistHandler) CheckQuery(query string) (bool, error) {
 	if len(handler.tables) != 0 {
 		parsedQuery, err := sqlparser.Parse(query)
 		if err != nil {
-			handler.logger.WithField(logging.FieldKeyEventCode, logging.EventCodeErrorCensorQueryParseError).WithError(ErrQuerySyntaxError).Errorln("Query has been blocked by whitelist [tables]. Parsing error")
+			handler.logger.WithField(logging.FieldKeyEventCode, logging.EventCodeErrorCensorQueryParseError).WithError(err).Errorln("Query has been blocked by whitelist [tables]. Parsing error")
 			return false, ErrQuerySyntaxError
 		}
 		switch parsedQuery := parsedQuery.(type) {

decryptor/mysql/response_proxy.go

@@ -307,7 +307,7 @@ func (handler *MysqlHandler) ClientToDbConnector(errCh chan<- error) {
 				if err == handlers.ErrQuerySyntaxError {
 					clientLog.WithError(err).Infof("Parsing error on query: %s", queryWithHiddenValues)
 				} else {
-					clientLog.WithField("sql", queryWithHiddenValues).Debugln("Com_query")
+					clientLog.WithFields(logrus.Fields{"sql": queryWithHiddenValues, "command": cmd}).Debugln("Query command")
 				}
 			}
 

tests/acra-censor_configs/acra-censor_blacklist.yaml

@@ -15,6 +15,8 @@ handlers:
       - SELECT CAST('test collated returns' AS CHAR CHARACTER SET utf8mb4) COLLATE utf8mb4_bin AS anon_1
       - select 1
       - SET AUTOCOMMIT = 0
+      - SET NAMES 'ascii' COLLATE 'ascii_general_ci'
+      - SET @@session.autocommit = OFF
       #postgres
       - BEGIN
       - "SELECT t.oid, typarray\nFROM pg_type t JOIN pg_namespace ns\n    ON typnamespace = ns.oid\nWHERE typname = 'hstore';\n"

tests/acra-censor_configs/acra-censor_whitelist.yaml

@@ -15,6 +15,8 @@ handlers:
       - SELECT CAST('test collated returns' AS CHAR CHARACTER SET utf8mb4) COLLATE utf8mb4_bin AS anon_1
       - select 1
       - SET AUTOCOMMIT = 0
+      - SET NAMES 'ascii' COLLATE 'ascii_general_ci'
+      - SET @@session.autocommit = OFF
       #postgres
       - BEGIN
       - "SELECT t.oid, typarray\nFROM pg_type t JOIN pg_namespace ns\n    ON typnamespace = ns.oid\nWHERE typname = 'hstore';\n"