diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 15d77f9f3e..f2916b1d13 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -2724,6 +2724,12 @@ public class WallVisitorUtils { } } + if ((!isWhite) && visitor.getDbType() == DbType.oracle) { + if (text.startsWith("+")) { + isWhite = true; + } + } + if (!isWhite) { addViolation(visitor, ErrorCode.EVIL_HINTS, "hint not allow", x); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/oracle/OracleWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/oracle/OracleWallTest.java index 64789100ad..ce176bdf5a 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/oracle/OracleWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/oracle/OracleWallTest.java @@ -27,10 +27,17 @@ public class OracleWallTest extends TestCase { public void testWall() throws Exception { WallConfig config = new WallConfig(); config.setSelectUnionCheck(true); - Assert.assertTrue(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2",config)); - Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2 --",config)); + assertTrue(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2",config)); + assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2 --",config)); - Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)")); + assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB")); + assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)")); + } + + public void testWall_1() throws Exception { + WallConfig config = new WallConfig(); + + assertTrue( + WallUtils.isValidateOracle("select/*+QUERY_TIMEOUT(600000000)*/ * from test_number",config)); } }