diff --git a/src/parser.js b/src/parser.js index e8807735..41268b83 100644 --- a/src/parser.js +++ b/src/parser.js @@ -46,7 +46,7 @@ class Parser { for (const authority of authorityList) { let hasCorrespondingAuthority = false for (const whiteAuthority of whiteList) { - const regex = new RegExp(whiteAuthority, 'i') + const regex = new RegExp(`^${whiteAuthority}$`, 'i') if (regex.test(authority)) { hasCorrespondingAuthority = true break diff --git a/test/select.spec.js b/test/select.spec.js index 27c39250..88398a0c 100644 --- a/test/select.spec.js +++ b/test/select.spec.js @@ -1244,6 +1244,12 @@ describe('select', () => { const fun = parser.whiteListCheck.bind(parser, sql, whiteList, mode) expect(fun).to.throw(`authority = 'select::b::name' is required in ${mode.type} whiteList to execute SQL = '${sql}'`) }) + it('should fail for prefix check', () => { + const sql = 'SELECT u.usernameXXX FROM user u;' + const whiteList = ['select::user::username'] + const fun = parser.whiteListCheck.bind(parser, sql, whiteList, { ...mode, database: 'postgresql' }) + expect(fun).to.throw(`authority = 'select::user::usernameXXX' is required in ${mode.type} whiteList to execute SQL = '${sql}'`) + }) it('should fail the complex sql and regex check', () => { const sql = 'UPDATE a SET id = 1 WHERE name IN (SELECT name FROM b)' const whiteList = ['select::(.*)::(id|name)']