improve wall filter

src/main/java/com/alibaba/druid/sql/ast/statement/SQLExprTableSource.java

@@ -37,6 +37,9 @@ public class SQLExprTableSource extends SQLTableSourceImpl {
     }
 
     public void setExpr(SQLExpr expr) {
+        if (expr != null) {
+            expr.setParent(this);
+        }
         this.expr = expr;
     }
 

src/main/java/com/alibaba/druid/sql/ast/statement/SQLSelect.java

@@ -32,7 +32,7 @@ public class SQLSelect extends SQLObjectImpl {
     }
     
     public SQLSelect(SQLSelectQuery query) {
-        this.query = query;
+        this.setQuery(query);
     }
 
     public SQLWithSubqueryClause getWithSubQuery() {
@@ -48,6 +48,9 @@ public class SQLSelect extends SQLObjectImpl {
     }
 
     public void setQuery(SQLSelectQuery query) {
+        if (query != null) {
+            query.setParent(this);
+        }
         this.query = query;
     }
 

src/main/java/com/alibaba/druid/sql/ast/statement/SQLSubqueryTableSource.java

@@ -33,12 +33,11 @@ public class SQLSubqueryTableSource extends SQLTableSourceImpl {
 
     public SQLSubqueryTableSource(SQLSelect select, String alias){
         super(alias);
-        this.select = select;
+        this.setSelect(select);
     }
 
     public SQLSubqueryTableSource(SQLSelect select){
-
-        this.select = select;
+        this.setSelect(select);
     }
 
     public SQLSelect getSelect() {
@@ -46,6 +45,9 @@ public class SQLSubqueryTableSource extends SQLTableSourceImpl {
     }
 
     public void setSelect(SQLSelect select) {
+        if (select != null) {
+            select.setParent(this);
+        }
         this.select = select;
     }
 

src/main/java/com/alibaba/druid/sql/ast/statement/SQLUnionQuery.java

@@ -44,6 +44,9 @@ public class SQLUnionQuery extends SQLSelectQuery {
     }
 
     public void setLeft(SQLSelectQuery left) {
+        if (left != null) {
+            left.setParent(this);
+        }
         this.left = left;
     }
 
@@ -52,6 +55,9 @@ public class SQLUnionQuery extends SQLSelectQuery {
     }
 
     public void setRight(SQLSelectQuery right) {
+        if (right != null) {
+            right.setParent(this);
+        }
         this.right = right;
     }
 
@@ -60,6 +66,9 @@ public class SQLUnionQuery extends SQLSelectQuery {
     }
 
     public void setOrderBy(SQLOrderBy orderBy) {
+        if (orderBy != null) {
+            orderBy.setParent(this);
+        }
         this.orderBy = orderBy;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlDeleteStatement.java

@@ -89,6 +89,9 @@ public class MySqlDeleteStatement extends SQLDeleteStatement {
     }
 
     public void setLimit(Limit limit) {
+        if (limit != null) {
+            limit.setParent(this);
+        }
         this.limit = limit;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlSelectQueryBlock.java

@@ -165,6 +165,9 @@ public class MySqlSelectQueryBlock extends SQLSelectQueryBlock implements MySqlO
     }
 
     public void setLimit(Limit limit) {
+        if (limit != null) {
+            limit.setParent(this);
+        }
         this.limit = limit;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowBinLogEventsStatement.java

@@ -57,6 +57,9 @@ public class MySqlShowBinLogEventsStatement extends MySqlStatementImpl implement
     }
 
     public void setLimit(Limit limit) {
+        if (limit != null) {
+            limit.setParent(this);
+        }
         this.limit = limit;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlUnionQuery.java

@@ -32,6 +32,9 @@ public class MySqlUnionQuery extends SQLUnionQuery implements MySqlObject {
     }
 
     public void setLimit(Limit limit) {
+        if (limit != null) {
+            limit.setParent(this);
+        }
         this.limit = limit;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlUpdateStatement.java

@@ -35,6 +35,9 @@ public class MySqlUpdateStatement extends SQLUpdateStatement implements MySqlSta
     }
 
     public void setLimit(Limit limit) {
+        if (limit != null) {
+            limit.setParent(this);
+        }
         this.limit = limit;
     }
 

src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlExprParser.java

@@ -299,7 +299,7 @@ public class MySqlExprParser extends SQLExprParser {
                 }
 
                 String unitVal = lexer.stringVal();
-                MySqlIntervalUnit unit = MySqlIntervalUnit.valueOf(unitVal);
+                MySqlIntervalUnit unit = MySqlIntervalUnit.valueOf(unitVal.toUpperCase());
                 lexer.nextToken();
 
                 accept(Token.FROM);

src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java

@@ -640,6 +640,10 @@ public class MySqlStatementParser extends SQLStatementParser {
 
     public SQLStatement parseShow() {
         acceptIdentifier("SHOW");
+        
+        if (lexer.token() == Token.COMMENT) {
+            lexer.nextToken();
+        }
 
         boolean full = false;
         if (lexer.token() == Token.FULL) {
@@ -1508,6 +1512,10 @@ public class MySqlStatementParser extends SQLStatementParser {
         MySqlReplaceStatement stmt = new MySqlReplaceStatement();
 
         acceptIdentifier(REPLACE);
+        
+        if (lexer.token() == Token.COMMENT) {
+            lexer.nextToken();
+        }
 
         if (identifierEquals(LOW_PRIORITY)) {
             stmt.setLowPriority(true);

src/main/java/com/alibaba/druid/util/IOUtils.java

@@ -44,6 +44,10 @@ public class IOUtils {
         InputStream in = null;
         try {
             in = Thread.currentThread().getContextClassLoader().getResourceAsStream(resource);
+            if (in == null) {
+                in = IOUtils.class.getResourceAsStream(resource);
+            }
+            
             if (in == null) {
                 return null;
             }

src/main/java/com/alibaba/druid/wall/WallConfig.java

@@ -36,6 +36,7 @@ public class WallConfig implements WallConfigMBean {
     private boolean             createTableAllow           = true;
     private boolean             dropTableAllow             = true;
     private boolean             alterTableAllow            = true;
+    private boolean             conditionAndAlwayTrueAllow = false;
 
     private boolean             selectAllColumnAllow       = true;
 
@@ -54,6 +55,7 @@ public class WallConfig implements WallConfigMBean {
     private boolean             replaceAllow               = true;
     private boolean             setAllow                   = true;
     private boolean             commitAllow                = true;
+    private boolean             rollbackAllow              = true;
     private boolean             useAllow                   = false;
 
     private boolean             multiStatementAllow        = false;
@@ -107,6 +109,14 @@ public class WallConfig implements WallConfigMBean {
 
     }
     
+    public boolean isConditionAndAlwayTrueAllow() {
+        return conditionAndAlwayTrueAllow;
+    }
+    
+    public void setConditionAndAlwayTrueAllow(boolean conditionAndAlwayTrueAllow) {
+        this.conditionAndAlwayTrueAllow = conditionAndAlwayTrueAllow;
+    }
+
     public boolean isUseAllow() {
         return useAllow;
     }
@@ -115,7 +125,6 @@ public class WallConfig implements WallConfigMBean {
         this.useAllow = useAllow;
     }
 
-
     public boolean isCommitAllow() {
         return commitAllow;
     }
@@ -124,6 +133,14 @@ public class WallConfig implements WallConfigMBean {
         this.commitAllow = commitAllow;
     }
 
+    public boolean isRollbackAllow() {
+        return rollbackAllow;
+    }
+
+    public void setRollbackAllow(boolean rollbackAllow) {
+        this.rollbackAllow = rollbackAllow;
+    }
+
     public boolean isIntersectAllow() {
         return intersectAllow;
     }

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -235,7 +235,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
             return false;
         }
 
-        if (!checkVar(x.getParent(), x.getName())) {
+        if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) {
             violations.add(new IllegalSQLObjectViolation("variable not allow : " + x.getName(), toSQL(x)));
         }
 

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -54,6 +54,7 @@ import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
 import com.alibaba.druid.sql.ast.statement.SQLInsertInto;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLJoinTableSource;
+import com.alibaba.druid.sql.ast.statement.SQLRollbackStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelect;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQuery;
@@ -189,7 +190,7 @@ public class WallVisitorUtils {
         SQLExpr where = x.getWhere();
 
         if (where != null) {
-            x.getWhere().setParent(x);
+            where.setParent(x);
             checkCondition(visitor, x.getWhere());
 
             if (Boolean.TRUE == getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck())) {
@@ -205,7 +206,7 @@ public class WallVisitorUtils {
                     }
                 }
 
-                if (!isSimpleConstExpr) {
+                if ((!isFirst(where)) && !isSimpleConstExpr) {
                     addViolation(visitor, "select alway true condition not allow", x);
                 }
             }
@@ -522,8 +523,10 @@ public class WallVisitorUtils {
             return null;
         }
 
-        Object leftResult = getValue(x.getLeft());
-        Object rightResult = getValue(x.getRight());
+        SQLExpr left = x.getLeft();
+        SQLExpr right = x.getRight();
+        Object leftResult = getValue(left);
+        Object rightResult = getValue(right);
 
         if (x.getOperator() == SQLBinaryOperator.BooleanAnd) {
             if (Boolean.FALSE == leftResult || Boolean.FALSE == rightResult) {
@@ -539,7 +542,14 @@ public class WallVisitorUtils {
                 }
             } else if (rightResult == Boolean.TRUE) {
                 final WallConditionContext current = wallConditionContextLocal.get();
-                if (current != null) {
+
+                boolean isLikeAlwayTrue = false;
+                if (right instanceof SQLBinaryOpExpr
+                    && ((SQLBinaryOpExpr) right).getOperator() == SQLBinaryOperator.Like) {
+                    isLikeAlwayTrue = true;
+                }
+
+                if (current != null && !isLikeAlwayTrue) {
                     current.setPartAlwayTrue(true);
                 }
             }
@@ -631,7 +641,7 @@ public class WallVisitorUtils {
             final Object value = getValue(x);
 
             final WallConditionContext current = wallConditionContextLocal.get();
-            if (current.hasPartAlwayTrue() && alwayTrueCheck) {
+            if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
                 addViolation(visitor, "part alway true condition not allow", x);
             }
 
@@ -801,7 +811,7 @@ public class WallVisitorUtils {
         }
 
         String methodName = x.getMethodName();
-        
+
         WallContext context = WallContext.current();
         if (context != null) {
             context.incrementFunctionInvoke(methodName);
@@ -974,29 +984,34 @@ public class WallVisitorUtils {
 
     public static void loadResource(Set<String> names, String resource) {
         try {
+            boolean hasResource = false;
             Enumeration<URL> e = Thread.currentThread().getContextClassLoader().getResources(resource);
             while (e.hasMoreElements()) {
                 URL url = e.nextElement();
                 InputStream in = null;
-                BufferedReader reader = null;
                 try {
                     in = url.openStream();
-                    reader = new BufferedReader(new InputStreamReader(in));
-                    for (;;) {
-                        String line = reader.readLine();
-                        if (line == null) {
-                            break;
-                        }
-                        line = line.trim();
-                        if (line.length() > 0) {
-                            line = line.toLowerCase();
-                            names.add(line);
-                        }
-                    }
+                    readFromInputStream(names, in);
 
-                    url.openStream();
+                    hasResource = true;
+                } finally {
+                    JdbcUtils.close(in);
+                }
+            }
+
+            // for aliyun odps
+            if (!hasResource) {
+                if (!resource.startsWith("/")) {
+                    resource = "/" + resource;
+                }
+
+                InputStream in = null;
+                try {
+                    in = WallVisitorUtils.class.getResourceAsStream(resource);
+                    if (in != null) {
+                        readFromInputStream(names, in);
+                    }
                 } finally {
-                    JdbcUtils.close(reader);
                     JdbcUtils.close(in);
                 }
             }
@@ -1005,6 +1020,26 @@ public class WallVisitorUtils {
         }
     }
 
+    private static void readFromInputStream(Set<String> names, InputStream in) throws IOException {
+        BufferedReader reader = null;
+        try {
+            reader = new BufferedReader(new InputStreamReader(in));
+            for (;;) {
+                String line = reader.readLine();
+                if (line == null) {
+                    break;
+                }
+                line = line.trim();
+                if (line.length() > 0) {
+                    line = line.toLowerCase();
+                    names.add(line);
+                }
+            }
+        } finally {
+            JdbcUtils.close(reader);
+        }
+    }
+
     public static void preVisitCheck(WallVisitor visitor, SQLObject x) {
         WallConfig config = visitor.getProvider().getConfig();
 
@@ -1064,6 +1099,9 @@ public class WallVisitorUtils {
         } else if (x instanceof MySqlCommitStatement) {
             allow = config.isCommitAllow();
             denyMessage = "show not allow";
+        } else if (x instanceof SQLRollbackStatement) {
+            allow = config.isRollbackAllow();
+            denyMessage = "show not allow";
         } else if (x instanceof SQLUseStatement) {
             allow = config.isUseAllow();
             denyMessage = "show not allow";

src/main/resources/META-INF/druid/wall/mysql/permit-variant.txt

@@ -19,4 +19,4 @@ sql_big_tables
 sql_mode
 tx_isolation
 warning_count
-@ret
+identity

src/test/java/com/alibaba/druid/bvt/filter/wall/IdentEqualsTest.java

@@ -24,7 +24,7 @@ import com.alibaba.druid.wall.WallUtils;
 
 public class IdentEqualsTest extends TestCase {
 
-    private String     sql    = "select * from t where id = id";
+    private String     sql    = "select * from t where FID = 1 OR id = id";
 
     private WallConfig config = new WallConfig();
 

src/test/java/com/alibaba/druid/bvt/filter/wall/IdentEqualsTest1.java

@@ -24,7 +24,7 @@ import com.alibaba.druid.wall.WallUtils;
 
 public class IdentEqualsTest1 extends TestCase {
 
-    private String     sql    = "select * from t where not (id != id)";
+    private String     sql    = "select * from t where FID = 1 OR not (id != id)";
 
     private WallConfig config = new WallConfig();
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest27.java

@@ -32,6 +32,6 @@ public class MySqlWallTest27 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where hex('abc') = '616263'")); //
+        "select * from t where FID = 1 OR hex('abc') = '616263'")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest28.java

@@ -32,6 +32,6 @@ public class MySqlWallTest28 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where hex(123) = '7B'")); //
+        "select * from t where FID = 1 OR hex(123) = '7B'")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest29.java

@@ -32,6 +32,6 @@ public class MySqlWallTest29 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where UNHEX('4D7953514C') = 'MySQL'")); //
+        "select * from t where FID = 1 OR UNHEX('4D7953514C') = 'MySQL'")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest30.java

@@ -32,6 +32,6 @@ public class MySqlWallTest30 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where UNHEX(HEX('MySQL')) = 'MySQL'")); //
+        "select * from t where FID = 1 OR UNHEX(HEX('MySQL')) = 'MySQL'")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest31.java

@@ -32,6 +32,6 @@ public class MySqlWallTest31 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where UNHEX(HEX(FNAME)) = FNAME")); //
+        "select * from t where FID = 1 OR UNHEX(HEX(FNAME)) = FNAME")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest32.java

@@ -32,21 +32,21 @@ public class MySqlWallTest32 extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where NOT(UNHEX(HEX(FNAME)) != FNAME)")); //
+        "select * from t where FID = 1 OR NOT(UNHEX(HEX(FNAME)) != FNAME)")); //
     }
     
     public void test_false_1() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where NOT(UNHEX(HEX(FNAME)) > FNAME)")); //
+        "select * from t where FID = 1 OR NOT(UNHEX(HEX(FNAME)) > FNAME)")); //
     }
     
     public void test_false_2() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where NOT(UNHEX(HEX(FNAME)) < FNAME)")); //
+        "select * from t where FID = 1 OR NOT(UNHEX(HEX(FNAME)) < FNAME)")); //
     }
     
     public void test_false_3() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-        "select * from t where NOT(UNHEX(HEX(FNAME)) NOT LIKE FNAME)")); //
+        "select * from t where FID = 1 OR NOT(UNHEX(HEX(FNAME)) NOT LIKE FNAME)")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest37.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.support.json.JSONUtils;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest37 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "call partnerAttribute(3061975048797781,105385028,5,@ret)")); //
+
+        Assert.assertEquals(0, provider.getTableStats().size());
+        System.out.println(JSONUtils.toJSONString(provider.getStatsMap()));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest38.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.support.json.JSONUtils;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest38 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "/* mysql-connector-java-5.1.20 ( Revision: tonci.grgin@oracle.com-20111003110438-qfydx066wsbydkbw ) */SELECT @@session.auto_increment_increment")); //
+
+        Assert.assertEquals(0, provider.getTableStats().size());
+        System.out.println(JSONUtils.toJSONString(provider.getStatsMap()));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest39.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.support.json.JSONUtils;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest39 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "COMMIT")); //
+
+        Assert.assertEquals(0, provider.getTableStats().size());
+        System.out.println(JSONUtils.toJSONString(provider.getStatsMap()));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest40 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertFalse(provider.checkValid(//
+        "use huaianapp")); //
+
+        Assert.assertEquals(0, provider.getTableStats().size());
+    }
+    
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setUseAllow(true);
+        
+        Assert.assertTrue(provider.checkValid(//
+                "use huaianapp")); //
+        
+        Assert.assertEquals(0, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest41.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest41 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT * FROM pw_pushdata WHERE invokepieceid= '49'  AND ifverify=0 AND starttime<= '1364976942'  ORDER BY vieworder DESC,starttime DESC  LIMIT 0")); //
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest42.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest42 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "SELECT COUNT(1) AS count FROM `team` " + //
+        "WHERE `team_type` = 'normal'  AND `city_id` IN (0,10) " + //
+        "AND (begin_time <= '1364832000')AND (end_time > '1364873430')AND (( title like '%%' ))AND (( `team_price` > '151' AND `team_price` <= '200'))AND ((now_number >= min_number)OR (end_time > '1364832000'))AND (group_id = 9 OR sub_id = 9)")); //
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest43 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT COUNT(1) AS count FROM `team` " + //
+        "WHERE `team_type` = 'normal' AND 1 = 1 AND `city_id` IN (0,10)"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+    
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setConditionAndAlwayTrueAllow(true);
+        
+        Assert.assertTrue(provider.checkValid(//
+                                               "SELECT COUNT(1) AS count FROM `team` " + //
+                "WHERE `team_type` = 'normal' AND 1 = 1 AND `city_id` IN (0,10)"));
+        
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest44.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest44 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT * FROM pw_pushdata WHERE invokepieceid= '49'  AND ifverify=0 AND starttime<= '1365331510'  ORDER BY vieworder DESC,starttime DESC  LIMIT 0"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest45.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest45 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "SELECT @1119453529t_processID, @1119453529t_ret"));
+
+        Assert.assertEquals(0, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest46.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest46 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "select aid,subject,dateline from www_subject where subject like '%%' order by aid desc limit 30;"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest47 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "update Fans," + //
+                " (select 361659 as ToID, 5 as Score " + //
+                "   union all select 382885 as ToID, 2 as Score" + //
+                "   union all select 407537 as ToID, 6 as Score) temp  " + //
+                "set Fans.score = Fans.score+temp.Score " + //
+                "where Fans.FansID = 382885 and Fans.UserID = temp.ToID"));
+
+        Assert.assertEquals(3, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest48.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest48 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "select sum(size) as total " + //
+                "from file " + //
+                "join file_to_post on file_to_post.file_id = file.id " + //
+                "join notice on file_to_post.post_id = notice.id " + //
+                "where profile_id = 18544 and file.url like '%/notice/%/file' AND EXTRACT(month FROM file.modified) = EXTRACT(month FROM now()) and EXTRACT(year FROM file.modified) = EXTRACT(year FROM now())"));
+
+        Assert.assertEquals(3, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest49.java

@@ -0,0 +1,65 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest49 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertFalse(provider.checkValid(//
+        "select temp.*, u.CanComment, u.CanBeShared, " + //
+                "   u.CanForward, COALESCE(b.UserID,0) as isBlocked, " + //
+                "   COALESCE(f.UserID,0) as Followed, COALESCE(ff.UserID,0) as IsFollowed, " + //
+                "   COALESCE(ul.UserID,0) as liked, " + //
+                "   COALESCE(fff.UserID,0) as RIsFollowed " + //
+                "from " + "(select 281319 as UserID, 0  as RUserID, 7797549 as PicID " + //
+                "   union all " + //
+                "   select 55608 as UserID, 0  as RUserID, 7797527 as PicID " + //
+                "   union all " + //
+                "   select 281319 as UserID, 0  as RUserID, 7797233 as PicID " + //
+                "   union all " + //
+                "   select 281319 as UserID, 0  as RUserID, 7797221 as PicID " + //
+                "   union all select 281319 as UserID, 0  as RUserID, 7797217 as PicID " + //
+                "   union all select 281319 as UserID, 0  as RUserID, 7797189 as PicID " + //
+                "   union all select 12271 as UserID, 0  as RUserID, 7796057 as PicID " + //
+                "   union all select 401697 as UserID, 494381  as RUserID, 7795057 as PicID " + //
+                "   union all select 401697 as UserID, 470693  as RUserID, 7795041 as PicID " + //
+                "   union all select 401697 as UserID, 470693  as RUserID, 7795039 as PicID) temp     " + //
+                "left join Users as u on u.UserID = temp.UserID   " + //
+                "left join BlockUser as b on b.UserID = temp.UserID and b.BlockUserID = 281319 " + //
+                "left join Fans as f on f.FansID = temp.UserID and f.UserID = 281319   " + //
+                "left join Fans as ff ON ff.FansID = 281319 and ff.UserID = temp.UserID   " + //
+                "left join Fans as fff ON fff.FansID = 281319 and fff.UserID = temp.RUserID   " + //
+                "left join UserLikes as ul on ul.PicID = temp.PicID and ul.UserID = 281319"));
+
+        Assert.assertEquals(4, provider.getTableStats().size());
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_1.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallUtils;
+
+/**
+ * SQLServerWallTest
+ *
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class SQLServerWallTest_1 extends TestCase {
+
+    public void test_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT @ret"));
+    }    
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_2.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallUtils;
+
+/**
+ * SQLServerWallTest
+ *
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class SQLServerWallTest_2 extends TestCase {
+
+    public void test_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateSqlServer("rollback"));
+    }    
+}