This commit is contained in:
温少
2012-03-17 01:43:43 +08:00
parent 86e96ad69f
commit 122d4de51f
5 changed files with 36 additions and 19 deletions
@@ -5,6 +5,8 @@ import static com.alibaba.druid.filter.wall.spi.WallVisitorUtils.loadResource;
import java.util.HashSet;
import java.util.Set;
import com.alibaba.druid.filter.wall.spi.WallVisitorUtils;
public class WallConfig {
private boolean selelctAllow = true;
@@ -170,4 +172,19 @@ public class WallConfig {
public Set<String> getPermitObjects() {
return permitObjects;
}
public boolean isPermitObjects(String name) {
name = WallVisitorUtils.form(name);
return permitObjects.contains(name);
}
public boolean isPermitSchema(String name) {
name = WallVisitorUtils.form(name);
return this.permitSchemas.contains(name);
}
public boolean isPermitFunction(String name) {
name = WallVisitorUtils.form(name);
return this.permitFunctions.contains(name);
}
}
@@ -13,7 +13,5 @@ public interface WallVisitor extends SQLASTVisitor {
boolean containsPermitTable(String name);
boolean containsPermitObjects(String name);
String toSQL(SQLObject obj);
}
@@ -46,11 +46,6 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
return config;
}
public boolean containsPermitObjects(String name) {
name = name.toLowerCase();
return config.getPermitObjects().contains(name);
}
public List<Violation> getViolations() {
return violations;
}
@@ -165,7 +160,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(SQLMethodInvokeExpr x) {
WallVisitorUtils.check(this, x);
WallVisitorUtils.checkFunction(this, x);
return true;
}
@@ -202,6 +197,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean containsPermitTable(String name) {
if (!config.isTableCheck()) {
return false;
}
name = WallVisitorUtils.form(name);
return config.getPermitTables().contains(name);
}
@@ -72,7 +72,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
@Override
public boolean visit(SQLMethodInvokeExpr x) {
WallVisitorUtils.check(this, x);
WallVisitorUtils.checkFunction(this, x);
return true;
}
@@ -127,6 +127,10 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
@Override
public boolean containsPermitTable(String name) {
if (!config.isTableCheck()) {
return false;
}
name = WallVisitorUtils.form(name);
if (name.startsWith("v$") || name.startsWith("v_$")) {
return true;
@@ -154,11 +158,6 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
}
}
@Override
public boolean containsPermitObjects(String name) {
return config.getPermitObjects().contains(name);
}
@Override
public boolean visit(SQLSelectStatement x) {
if (!config.isSelelctAllow()) {
@@ -47,7 +47,7 @@ public class WallVisitorUtils {
if (x.getOwner() instanceof SQLIdentifierExpr) {
String owner = x.getOwner().toString();
owner = WallVisitorUtils.form(owner);
if (visitor.containsPermitObjects(owner)) {
if (visitor.getConfig().isPermitObjects(owner)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
}
}
@@ -387,18 +387,22 @@ public class WallVisitorUtils {
return false;
}
public static void check(WallVisitor visitor, SQLMethodInvokeExpr x) {
public static void checkFunction(WallVisitor visitor, SQLMethodInvokeExpr x) {
if (x.getOwner() instanceof SQLIdentifierExpr) {
String owner = x.getOwner().toString();
owner = WallVisitorUtils.form(owner);
if (visitor.containsPermitObjects(owner)) {
if (visitor.getConfig().isPermitObjects(owner)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
}
}
if (!visitor.getConfig().isFunctionCheck()) {
return;
}
String methodName = x.getMethodName();
if (visitor.getConfig().getPermitFunctions().contains(methodName.toLowerCase())) {
if (visitor.getConfig().isPermitFunction(methodName.toLowerCase())) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
}