{"componentChunkName":"component---src-templates-acg-portal-new-template-tsx","path":"/Zmrwxthz0","result":{"data":{"markdownRemark":{"html":"

本文档介绍StarRocks引擎支持的SQL防御规则及推荐的SQL写法。SQL防御的功能说明、规则分类、命中动作以及新增规则、查看系统规则等操作方式请参见SQL防御功能。本文仅针对StarRocks引擎的规则支持情况和使用建议进行说明。

\n

StarRocks支持的防御规则

\n

StarRocks支持通用的静态、动态、运行时规则，并额外支持基于CPU运行时间的运行时规则，用于管控占用大量CPU资源的SQL。

\n

静态规则（SQL文本检测）

\n

表一 StarRocks静态规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值SQL示例
static_0001SQL中COUNT(DISTINCT)出现次数超限10SELECT COUNT(DISTINCT a), COUNT(DISTINCT b) FROM t
static_0002SQL中使用了NOT IN <subquery>—SELECT * FROM t WHERE id NOT IN (SELECT id FROM t2)
static_0003SQL中JOIN次数超限20多表JOIN场景
static_0004SQL中UNION ALL次数超限20多个SELECT ... UNION ALL SELECT ...
static_0005子查询嵌套层数超限20SELECT * FROM (SELECT * FROM (SELECT ...))
static_0006SQL语句字符串长度超限（单位KB）10超长SQL语句
static_0007多表关联时存在笛卡尔积—SELECT * FROM A, B
\n

动态规则（执行计划检测）

\n

表二 StarRocks动态规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值
dynamic_0001扫描文件数超限100000
dynamic_0002单表操作（SELECT/DELETE/UPDATE/ALTER）涉及分区数超限10000
\n

运行时规则（执行中检测）

\n

表三 StarRocks运行时规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值
running_0001SELECT返回结果行数超限100000
running_0002SQL占用内存峰值超限（单位MB）按集群配置
running_0003SQL已运行时长超限（单位秒）按业务需求
running_0004SQL已扫描数据量超限（单位GB）10240
running_0005SQL运行CPU时间超限（单位秒）180
\n
\n

说明：running_0005（SQL运行CPU时间超限）为StarRocks独享规则，用于管控占用大量CPU计算资源的SQL。

\n
\n

推荐SQL写法

\n

查询明细数据时添加过滤条件和LIMIT，避免触发running_0001返回结果行数超限：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT *\n2FROM user_event_detail\n3WHERE event_date = '2026-07-03'\n4LIMIT 100;
\n
\n
\n
\n \n

分区表查询带上分区字段，避免触发dynamic_0002分区数超限：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT city, count(*) AS cnt\n2FROM user_event_detail\n3WHERE event_date >= '2026-07-01'\n4  AND event_date < '2026-07-04'\n5GROUP BY city;
\n
\n
\n
\n \n

JOIN查询必须包含明确的JOIN条件，避免触发static_0007笛卡尔积拦截：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT a.user_id, a.event_type, b.name\n2FROM user_event_detail a\n3JOIN tb_primary_key b\n4  ON a.user_id = b.user_id\n5WHERE a.event_date = '2026-07-03';
\n
\n
\n
\n \n

复杂聚合和大范围扫描的SQL注意控制CPU消耗，避免触发running_0005 CPU时间超限。

\n

不推荐SQL写法

\n

以下写法可能被防御规则拦截：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1-- 无过滤条件扫描大表（触发 running_0001/running_0004）\n2SELECT * FROM user_event_detail;\n3\n4-- 无JOIN条件笛卡尔积（触发 static_0007）\n5SELECT * FROM table_a, table_b;\n6\n7-- 无条件删除全表\n8DELETE FROM user_event_detail;\n9\n10-- NOT IN 子查询（触发 static_0002）\n11SELECT * FROM t WHERE id NOT IN (SELECT id FROM t2 WHERE status=0);\n12\n13-- 过多 COUNT(DISTINCT)（触发 static_0001）\n14SELECT COUNT(DISTINCT a), COUNT(DISTINCT b), COUNT(DISTINCT c),\n15       COUNT(DISTINCT d), COUNT(DISTINCT e), COUNT(DISTINCT f),\n16       COUNT(DISTINCT g), COUNT(DISTINCT h), COUNT(DISTINCT i),\n17       COUNT(DISTINCT j), COUNT(DISTINCT k)\n18FROM big_table;
\n
\n
\n
\n \n
\n

说明：以上规则的启用状态、阈值和命中动作均需在防御规则页面配置，配置方式请参见SQL防御功能。

\n
","fields":{"slug":"Zmrwxthz0","title":"StarRocks SQL防御","date":"2026-07-24","extractedHeadings":[]},"headings":[{"value":"StarRocks支持的防御规则","depth":2},{"value":"静态规则（SQL文本检测）","depth":3},{"value":"动态规则（执行计划检测）","depth":3},{"value":"运行时规则（执行中检测）","depth":3},{"value":"推荐SQL写法","depth":2},{"value":"不推荐SQL写法","depth":2}]}},"pageContext":{"isCreatedByStatefulCreatePages":false,"slug":"Zmrwxthz0","prev":{"id":"Mmrueitdb","name":"StarRocks Query Profile介绍","path":"Mmrueitdb","filePath":"开源组件介绍/StarRocks/StarRocks Query Profile介绍.md","seo":null,"parentIds":["ejwvxvcqb","qmruct35p"],"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"qmruct35p","documentId":"ba1be660-ef60-40dc-982b-516db6730c54","name":"StarRocks","repoName":"BMR","filePath":"开源组件介绍/StarRocks","disabled":false,"path":"qmruct35p","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""}]},"next":{"id":"fjx49lo78","name":"BMR on BCC操作指南","path":"fjx49lo78","filePath":"BMR on BCC操作指南/集群配置/创建集群.md","seo":null,"parentIds":["Vjwvxvj67","Ejx498d60"],"parents":[{"id":"Vjwvxvj67","documentId":"0538663f-1815-42a7-8f22-c4fc2f9fff6e","name":"BMR on BCC操作指南","repoName":"BMR","filePath":"BMR on BCC操作指南","disabled":false,"path":"Vjwvxvj67","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"Ejx498d60","documentId":"2ca8810c-bf4b-441d-ba86-24459c8bfbe7","name":"集群配置","repoName":"BMR","filePath":"BMR on BCC操作指南/集群配置","disabled":false,"path":"Ejx498d60","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}]},"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"qmruct35p","documentId":"ba1be660-ef60-40dc-982b-516db6730c54","name":"StarRocks","repoName":"BMR","filePath":"开源组件介绍/StarRocks","disabled":false,"path":"qmruct35p","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""}],"specificSeo":null}}}