{"componentChunkName":"component---src-templates-acg-portal-new-template-tsx","path":"/qmrwxxic9","result":{"data":{"markdownRemark":{"html":"

本文档介绍ClickHouse引擎支持的SQL防御规则及推荐的SQL写法。SQL防御的功能说明、规则分类、命中动作以及新增规则、查看系统规则等操作方式请参见SQL防御功能。本文仅针对ClickHouse引擎的规则支持情况和使用建议进行说明。

\n

ClickHouse支持的防御规则

\n

ClickHouse除支持通用的静态、动态、运行时规则外，还支持一批针对集群级别（on cluster）操作的独享规则，用于防止在整个集群上执行高风险的DDL和数据变更操作。

\n

静态规则（SQL文本检测）

\n

表一 ClickHouse静态规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值SQL示例
static_0001SQL中COUNT(DISTINCT)出现次数超限10SELECT COUNT(DISTINCT a), COUNT(DISTINCT b) FROM t
static_0002SQL中使用了NOT IN <subquery>—SELECT * FROM t WHERE id NOT IN (SELECT id FROM t2)
static_0003SQL中JOIN次数超限20多表JOIN场景
static_0004SQL中UNION ALL次数超限20多个SELECT ... UNION ALL SELECT ...
static_0005子查询嵌套层数超限20SELECT * FROM (SELECT * FROM (SELECT ...))
static_0006SQL语句字符串长度超限（单位KB）10超长SQL语句
static_0007多表关联时存在笛卡尔积—SELECT * FROM A, B
\n

ClickHouse独享静态规则（集群级别操作）

\n

表二 ClickHouse集群级别操作规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述SQL示例
static_0008集群级别（on cluster）执行ALTER TABLE UPDATE操作ALTER TABLE testtb1 ON CLUSTER default_cluster UPDATE price=10.0 WHERE id='100'
static_0009集群级别（on cluster）执行ALTER TABLE DELETE操作ALTER TABLE testtb1 ON CLUSTER default_cluster DELETE WHERE id='10'
static_0010集群级别（on cluster）执行ALTER TABLE ADD COLUMN操作ALTER TABLE testtb1 ON CLUSTER default_cluster ADD COLUMN testc String
static_0011集群级别（on cluster）执行ALTER TABLE DROP COLUMN操作ALTER TABLE testtb1 ON CLUSTER default_cluster DROP COLUMN testc
static_0012集群级别（on cluster）执行OPTIMIZE FINAL操作OPTIMIZE TABLE testtb1 ON CLUSTER default_cluster FINAL
static_0013集群级别（on cluster）执行DROP TABLE操作DROP TABLE testtb1 ON CLUSTER default_cluster
static_0014集群级别（on cluster）执行TRUNCATE TABLE操作TRUNCATE TABLE testtb1 ON CLUSTER default_cluster
\n

动态规则（执行计划检测）

\n

表三 ClickHouse动态规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值
dynamic_0001扫描文件数超限100000
dynamic_0002单表操作（SELECT/DELETE/UPDATE/ALTER）涉及分区数超限10000
dynamic_0003JOIN右表为分布式表时，右表数据量超限100000000
\n

运行时规则（执行中检测）

\n

表四 ClickHouse运行时规则

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
规则ID规则描述建议阈值
running_0001SELECT返回结果行数超限100000
running_0002SQL占用内存峰值超限（单位MB）按集群配置
running_0003SQL已运行时长超限（单位秒）按业务需求
running_0004SQL已扫描数据量超限（单位GB）10240
\n

推荐SQL写法

\n

查询明细数据时添加过滤条件和LIMIT，避免触发running_0001返回结果行数超限：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT *\n2FROM user_event_detail\n3WHERE event_date = '2026-07-03'\n4LIMIT 100;
\n
\n
\n
\n \n

分区表查询带上分区字段，避免触发dynamic_0002分区数超限：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT city, count(*) AS cnt\n2FROM user_event_detail\n3WHERE event_date >= '2026-07-01'\n4  AND event_date < '2026-07-04'\n5GROUP BY city;
\n
\n
\n
\n \n

JOIN查询必须包含明确的JOIN条件，避免触发static_0007笛卡尔积拦截：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1SELECT a.user_id, a.event_type, b.name\n2FROM user_event_detail a\n3JOIN tb_primary_key b\n4  ON a.user_id = b.user_id\n5WHERE a.event_date = '2026-07-03';
\n
\n
\n
\n \n

集群级别的DDL和数据变更操作影响范围大，建议在单节点或明确评估影响后执行，避免触发static_0008至static_0014等on cluster规则。

\n

不推荐SQL写法

\n

以下写法可能被防御规则拦截：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1-- 无过滤条件扫描大表（触发 running_0001/running_0004）\n2SELECT * FROM user_event_detail;\n3\n4-- 无JOIN条件笛卡尔积（触发 static_0007）\n5SELECT * FROM table_a, table_b;\n6\n7-- 集群级别删除全表（触发 static_0009/static_0014）\n8TRUNCATE TABLE user_event_detail ON CLUSTER default_cluster;\n9\n10-- NOT IN 子查询（触发 static_0002）\n11SELECT * FROM t WHERE id NOT IN (SELECT id FROM t2 WHERE status=0);\n12\n13-- 过多 COUNT(DISTINCT)（触发 static_0001）\n14SELECT COUNT(DISTINCT a), COUNT(DISTINCT b), COUNT(DISTINCT c),\n15       COUNT(DISTINCT d), COUNT(DISTINCT e), COUNT(DISTINCT f),\n16       COUNT(DISTINCT g), COUNT(DISTINCT h), COUNT(DISTINCT i),\n17       COUNT(DISTINCT j), COUNT(DISTINCT k)\n18FROM big_table;
\n
\n
\n
\n \n
\n

说明：以上规则的启用状态、阈值和命中动作均需在防御规则页面配置，配置方式请参见SQL防御功能。

\n
","fields":{"slug":"qmrwxxic9","title":"ClickHouse SQL防御","date":"2026-07-24","extractedHeadings":[]},"headings":[{"value":"ClickHouse支持的防御规则","depth":2},{"value":"静态规则（SQL文本检测）","depth":3},{"value":"ClickHouse独享静态规则（集群级别操作）","depth":3},{"value":"动态规则（执行计划检测）","depth":3},{"value":"运行时规则（执行中检测）","depth":3},{"value":"推荐SQL写法","depth":2},{"value":"不推荐SQL写法","depth":2}]}},"pageContext":{"isCreatedByStatefulCreatePages":false,"slug":"qmrwxxic9","prev":{"id":"9mq62ikb8","name":"数据重分布使用说明","path":"9mq62ikb8","filePath":"开源组件介绍/ClickHouse/运维相关操作/数据重分布使用说明.md","seo":null,"parentIds":["ejwvxvcqb","2m64f4p1k","Sm64fba3r"],"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"2m64f4p1k","documentId":"0ecab53a-49c0-4bb1-9066-db2d01b50eaa","name":"ClickHouse","repoName":"BMR","filePath":"开源组件介绍/ClickHouse","disabled":false,"path":"2m64f4p1k","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"Sm64fba3r","documentId":"270cc033-2308-4a71-bbca-e7e69f69cc87","name":"运维相关操作","repoName":"BMR","filePath":"开源组件介绍/ClickHouse/运维相关操作","disabled":false,"path":"Sm64fba3r","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}]},"next":{"id":"Jm64pm6kl","name":"常见问题","path":"Jm64pm6kl","filePath":"开源组件介绍/ClickHouse/常见问题.md","seo":null,"parentIds":["ejwvxvcqb","2m64f4p1k"],"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"2m64f4p1k","documentId":"0ecab53a-49c0-4bb1-9066-db2d01b50eaa","name":"ClickHouse","repoName":"BMR","filePath":"开源组件介绍/ClickHouse","disabled":false,"path":"2m64f4p1k","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}]},"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"2m64f4p1k","documentId":"0ecab53a-49c0-4bb1-9066-db2d01b50eaa","name":"ClickHouse","repoName":"BMR","filePath":"开源组件介绍/ClickHouse","disabled":false,"path":"2m64f4p1k","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"Sm64fba3r","documentId":"270cc033-2308-4a71-bbca-e7e69f69cc87","name":"运维相关操作","repoName":"BMR","filePath":"开源组件介绍/ClickHouse/运维相关操作","disabled":false,"path":"Sm64fba3r","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}],"specificSeo":null}}}