diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBetweenExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBetweenExpr.java index 5ddc9b7a35..ed08ed9844 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBetweenExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBetweenExpr.java @@ -34,18 +34,14 @@ public class SQLBetweenExpr extends SQLExprImpl implements Serializable { } public SQLBetweenExpr(SQLExpr testExpr, SQLExpr beginExpr, SQLExpr endExpr){ - - this.testExpr = testExpr; - this.beginExpr = beginExpr; - this.endExpr = endExpr; + setTestExpr(testExpr); + setBeginExpr(beginExpr); + setEndExpr(endExpr); } public SQLBetweenExpr(SQLExpr testExpr, boolean not, SQLExpr beginExpr, SQLExpr endExpr){ - - this.testExpr = testExpr; + this(testExpr, beginExpr, endExpr); this.not = not; - this.beginExpr = beginExpr; - this.endExpr = endExpr; } public void output(StringBuffer buf) { @@ -74,6 +70,9 @@ public class SQLBetweenExpr extends SQLExprImpl implements Serializable { } public void setTestExpr(SQLExpr testExpr) { + if (testExpr != null) { + testExpr.setParent(this); + } this.testExpr = testExpr; } @@ -90,6 +89,9 @@ public class SQLBetweenExpr extends SQLExprImpl implements Serializable { } public void setBeginExpr(SQLExpr beginExpr) { + if (beginExpr != null) { + beginExpr.setParent(this); + } this.beginExpr = beginExpr; } @@ -98,6 +100,9 @@ public class SQLBetweenExpr extends SQLExprImpl implements Serializable { } public void setEndExpr(SQLExpr endExpr) { + if (endExpr != null) { + endExpr.setParent(this); + } this.endExpr = endExpr; } diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLMethodInvokeExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLMethodInvokeExpr.java index 67063a4370..e9848e2b14 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLMethodInvokeExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLMethodInvokeExpr.java @@ -42,7 +42,7 @@ public class SQLMethodInvokeExpr extends SQLExprImpl implements Serializable { public SQLMethodInvokeExpr(String methodName, SQLExpr owner){ this.methodName = methodName; - this.owner = owner; + setOwner(owner); } public String getMethodName() { @@ -58,6 +58,9 @@ public class SQLMethodInvokeExpr extends SQLExprImpl implements Serializable { } public void setOwner(SQLExpr owner) { + if (owner != null) { + owner.setParent(this); + } this.owner = owner; } diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLQueryExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLQueryExpr.java index bb2e586f51..f70e6e6f7b 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLQueryExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLQueryExpr.java @@ -31,8 +31,7 @@ public class SQLQueryExpr extends SQLExprImpl implements Serializable { } public SQLQueryExpr(SQLSelect select){ - - this.subQuery = select; + setSubQuery(select); } public SQLSelect getSubQuery() { @@ -40,6 +39,9 @@ public class SQLQueryExpr extends SQLExprImpl implements Serializable { } public void setSubQuery(SQLSelect subQuery) { + if (subQuery != null) { + subQuery.setParent(this); + } this.subQuery = subQuery; } diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlExprParser.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlExprParser.java index f9676cff31..ad4abceac8 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlExprParser.java @@ -430,7 +430,7 @@ public class MySqlExprParser extends SQLExprParser { SQLMethodInvokeExpr methodInvokeExpr = new SQLMethodInvokeExpr(ident); if (lexer.token() != Token.RPAREN) { - exprList(methodInvokeExpr.getParameters()); + exprList(methodInvokeExpr.getParameters(), methodInvokeExpr); } if (identifierEquals("USING")) { @@ -454,11 +454,11 @@ public class MySqlExprParser extends SQLExprParser { accept(Token.IN); SQLExpr str = this.expr(); accept(Token.RPAREN); - + SQLMethodInvokeExpr locate = new SQLMethodInvokeExpr("LOCATE"); locate.getParameters().add(subStr); locate.getParameters().add(str); - + expr = locate; return primaryRest(expr); } @@ -536,7 +536,7 @@ public class MySqlExprParser extends SQLExprParser { SQLExpr expr = this.expr(); ((MySqlSQLColumnDefinition) column).setOnUpdate(expr); } - + if (identifierEquals("AUTO_INCREMENT")) { lexer.nextToken(); if (column instanceof MySqlSQLColumnDefinition) { @@ -552,13 +552,13 @@ public class MySqlExprParser extends SQLExprParser { if (identifierEquals("PARTITION")) { throw new ParserException("syntax error " + lexer.token() + " " + lexer.stringVal()); } - + if (identifierEquals("COMMENT")) { lexer.nextToken(); column.setComment(lexer.stringVal()); accept(Token.LITERAL_CHARS); } - + if (identifierEquals("STORAGE")) { lexer.nextToken(); SQLExpr expr = expr(); @@ -566,15 +566,15 @@ public class MySqlExprParser extends SQLExprParser { ((MySqlSQLColumnDefinition) column).setStorage(expr); } } - + super.parseColumnRest(column); return column; } - + protected SQLDataType parseDataTypeRest(SQLDataType dataType) { super.parseDataTypeRest(dataType); - + if (identifierEquals("UNSIGNED")) { lexer.nextToken(); dataType.getAttributes().put("unsigned", true); @@ -718,9 +718,9 @@ public class MySqlExprParser extends SQLExprParser { public MySqlUnique parseUnique() { accept(Token.UNIQUE); - + if (lexer.token() == Token.KEY) { - lexer.nextToken(); + lexer.nextToken(); } MySqlUnique unique = new MySqlUnique(); @@ -730,12 +730,12 @@ public class MySqlExprParser extends SQLExprParser { unique.setIndexType(lexer.stringVal()); lexer.nextToken(); } - + if (lexer.token() != Token.LPAREN) { - SQLName name = name(); - unique.setName(name); + SQLName name = name(); + unique.setName(name); } - + accept(Token.LPAREN); for (;;) { unique.getColumns().add(this.expr()); @@ -749,21 +749,21 @@ public class MySqlExprParser extends SQLExprParser { return unique; } - + public MySqlForeignKey parseForeignKey() { accept(Token.FOREIGN); accept(Token.KEY); - + MySqlForeignKey fk = new MySqlForeignKey(); - + accept(Token.LPAREN); this.names(fk.getReferencingColumns()); accept(Token.RPAREN); - + accept(Token.REFERENCES); - + fk.setReferencedTableName(this.name()); - + accept(Token.LPAREN); this.names(fk.getReferencedColumns()); accept(Token.RPAREN); diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java index 46790d1c67..d78e405e37 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java @@ -578,7 +578,7 @@ public class SQLExprParser extends SQLParser { methodInvokeExpr.getParameters().add(new SQLIdentifierExpr("+")); lexer.nextToken(); } else { - exprList(methodInvokeExpr.getParameters()); + exprList(methodInvokeExpr.getParameters(), methodInvokeExpr); } accept(Token.RPAREN); } @@ -612,7 +612,7 @@ public class SQLExprParser extends SQLParser { exprCol.add(name()); } } - + public final void exprList(Collection exprCol) { exprList(exprCol, null); } @@ -1264,7 +1264,7 @@ public class SQLExprParser extends SQLParser { column.getConstaints().add(new SQLColumnPrimaryKey()); return parseColumnRest(column); } - + if (lexer.token == Token.CHECK) { lexer.nextToken(); SQLExpr expr = this.expr(); diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index fdfd160a46..e5162fc945 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -796,7 +796,7 @@ public class SQLEvalVisitorUtils { if (wallConditionContext != null) { wallConditionContext.setConstArithmetic(true); } - + if (leftValue == null || rightValue == null) { return false; } @@ -1290,7 +1290,7 @@ public class SQLEvalVisitorUtils { } if (a instanceof String || b instanceof String) { - return ((String) a).compareTo((String) b) < 0; + return (castToString(a)).compareTo(castToString(b)) < 0; } if (a instanceof BigDecimal || b instanceof BigDecimal) { diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 7a05993100..b258b181c4 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -163,11 +163,16 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(SQLInsertStatement x) { + WallVisitorUtils.initWallTopStatementContext(); WallVisitorUtils.checkInsert(this, x); - return true; } + @Override + public void endVisit(SQLInsertStatement x) { + WallVisitorUtils.clearWallTopStatementContext(); + } + @Override public boolean visit(SQLSelectStatement x) { if (!config.isSelelctAllow()) { diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index c6e43a7a36..a56bc930bf 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -124,6 +124,11 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements @Override public boolean visit(SQLMethodInvokeExpr x) { + + if (x.getParent() instanceof SQLExprTableSource) { + WallVisitorUtils.checkFunctionInTableSource(this, x); + } + WallVisitorUtils.checkFunction(this, x); return true; @@ -188,10 +193,16 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements @Override public boolean visit(SQLInsertStatement x) { + WallVisitorUtils.initWallTopStatementContext(); WallVisitorUtils.checkInsert(this, x); return true; } + @Override + public void endVisit(SQLInsertStatement x) { + WallVisitorUtils.clearWallTopStatementContext(); + } + @Override public boolean visit(SQLDeleteStatement x) { WallVisitorUtils.checkDelete(this, x); diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 12efca3080..31034eda9c 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -37,6 +37,7 @@ import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator; import com.alibaba.druid.sql.ast.expr.SQLCharExpr; import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr; import com.alibaba.druid.sql.ast.expr.SQLInListExpr; +import com.alibaba.druid.sql.ast.expr.SQLInSubQueryExpr; import com.alibaba.druid.sql.ast.expr.SQLIntegerExpr; import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; import com.alibaba.druid.sql.ast.expr.SQLNCharExpr; @@ -703,6 +704,17 @@ public class WallVisitorUtils { return false; } + private static boolean hasWhere(SQLSelectQuery selectQuery) { + + if (selectQuery instanceof SQLSelectQueryBlock) { + return ((SQLSelectQueryBlock) selectQuery).getWhere() != null; + } else if (selectQuery instanceof SQLUnionQuery) { + SQLUnionQuery union = (SQLUnionQuery) selectQuery; + return hasWhere(union.getLeft()) || hasWhere(union.getRight()); + } + return false; + } + public static boolean isWhereOrHaving(SQLObject x) { if (x == null) { return false; @@ -715,12 +727,17 @@ public class WallVisitorUtils { return false; } + if (parent instanceof SQLUnionQuery) { + SQLUnionQuery union = (SQLUnionQuery) parent; + if (union.getRight() == x && hasWhere(union.getLeft())) { + return true; + } + } + if (parent instanceof SQLSelectQueryBlock) { SQLSelectQueryBlock query = (SQLSelectQueryBlock) parent; if (query.getWhere() == x) { return true; - } else { - return false; } } @@ -1037,6 +1054,25 @@ public class WallVisitorUtils { return false; } + public static void checkFunctionInTableSource(WallVisitor visitor, SQLMethodInvokeExpr x) { + final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get(); + if (topStatementContext != null && (topStatementContext.fromSysSchema || topStatementContext.fromSysTable)) { + return; + } + + checkSchema(visitor, x.getOwner()); + + String methodName = x.getMethodName(); + if (!visitor.getProvider().checkDenyTable(methodName)) { + if (isTopUpdateStatement(x) || isFirstSelectTableSource(x)) { + if (topStatementContext != null) { + topStatementContext.setFromSysSchema(Boolean.TRUE); + clearViolation(visitor); + } + } + } + } + public static void checkFunction(WallVisitor visitor, SQLMethodInvokeExpr x) { final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get(); @@ -1113,6 +1149,14 @@ public class WallVisitorUtils { } public static boolean isTopNoneFromSelect(WallVisitor visitor, SQLObject x) { + for (;;) { + if (x.getParent() instanceof SQLExpr) { + x = x.getParent(); + } else { + break; + } + } + if (!(x.getParent() instanceof SQLSelectItem)) { return false; } @@ -1152,10 +1196,8 @@ public class WallVisitorUtils { String owner = ((SQLName) x).getSimleName(); owner = WallVisitorUtils.form(owner); if (!visitor.getProvider().checkDenySchema(owner)) { - boolean topStatement = isTopSelectStatement(x) || isTopUpdateStatement(x); - boolean isWhereOrHaving = isWhereOrHaving(x); - if (!topStatement && isWhereOrHaving) { + if (!isTopUpdateStatement(x) && !isFirstSelectTableSource(x)) { SQLObject parent = x.getParent(); while (parent != null && !(parent instanceof SQLStatement)) { parent = parent.getParent(); @@ -1194,6 +1236,7 @@ public class WallVisitorUtils { } else { if (topStatementContext != null) { topStatementContext.setFromSysSchema(Boolean.TRUE); + clearViolation(visitor); } } return true; @@ -1213,55 +1256,127 @@ public class WallVisitorUtils { return true; } - private static boolean isTopSelectStatement(SQLObject x) { + private static boolean isFirstSelectTableSource(SQLObject x) { - boolean topSelectStatement = false; + for (;;) { + if (x instanceof SQLExpr) { + x = x.getParent(); + } else { + break; + } + } + + if (!(x instanceof SQLExprTableSource)) { + return false; + } + + SQLSelectQueryBlock queryBlock = null; SQLObject parent = x.getParent(); while (parent != null) { - if (parent instanceof SQLSelectStatement || parent instanceof MySqlShowStatement) { - parent = parent.getParent(); - if (parent == null) { - topSelectStatement = true; + if (parent instanceof SQLJoinTableSource) { + SQLJoinTableSource join = (SQLJoinTableSource) parent; + if (join.getRight() == x && hasTableSource(join.getLeft())) { + return false; } - break; } - if (parent instanceof SQLUnionQuery) { - SQLUnionQuery union = (SQLUnionQuery) parent; - if (union.getRight() == x) { - break; - } + if (parent instanceof SQLSelectQueryBlock) { + queryBlock = (SQLSelectQueryBlock) parent; + break; } x = parent; parent = x.getParent(); } - return topSelectStatement; + if (queryBlock == null) { + return false; + } + + boolean isQueryExpr = false; + do { + x = parent; + parent = parent.getParent(); + if (parent instanceof SQLUnionQuery) { + SQLUnionQuery union = (SQLUnionQuery) parent; + if (union.getRight() == x && hasTableSource(union.getLeft())) { + return false; + } + } else if (parent instanceof SQLQueryExpr || parent instanceof SQLInSubQueryExpr) { + isQueryExpr = true; + } else if (isQueryExpr && parent instanceof SQLSelectQueryBlock) { + if (hasTableSource((SQLSelectQueryBlock) parent)) { + return false; + } + } + } while (parent != null); + + return true; + } + + private static boolean hasTableSource(SQLSelectQuery x) { + + if (x instanceof SQLUnionQuery) { + SQLUnionQuery union = (SQLUnionQuery) x; + return hasTableSource(union.getLeft()) || hasTableSource(union.getRight()); + } else if (x instanceof SQLSelectQueryBlock) { + return hasTableSource(((SQLSelectQueryBlock) x).getFrom()); + } + + return false; + } + + private static boolean hasTableSource(SQLTableSource x) { + if (x == null) { + return false; + } + + if (x instanceof SQLExprTableSource) { + SQLExpr fromExpr = ((SQLExprTableSource) x).getExpr(); + if (fromExpr instanceof SQLName) { + String name = fromExpr.toString(); + name = form(name); + if (name.equalsIgnoreCase("DUAL")) { + return false; + } + } + return true; + } else if (x instanceof SQLJoinTableSource) { + SQLJoinTableSource join = (SQLJoinTableSource) x; + return hasTableSource(join.getLeft()) || hasTableSource(join.getRight()); + } else if (x instanceof SQLSubqueryTableSource) { + return hasTableSource(((SQLSubqueryTableSource) x).getSelect().getQuery()); + } + + return false; } private static boolean isTopUpdateStatement(SQLObject x) { - boolean topUpdateStatement = false; - while (x != null) { + + for (;;) { + if (x instanceof SQLExpr) { + x = x.getParent(); + } else { + break; + } + } + + if (x instanceof SQLExprTableSource) { + x = x.getParent(); + if (x instanceof SQLUpdateStatement) { x = x.getParent(); if (x == null) { - topUpdateStatement = true; + return true; } - break; } - x = x.getParent(); } - - return topUpdateStatement; + return false; } public static boolean check(WallVisitor visitor, SQLExprTableSource x) { final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get(); - if (topStatementContext != null && (topStatementContext.fromSysSchema || topStatementContext.fromSysTable)) { - return true; - } SQLExpr expr = x.getExpr(); if (expr instanceof SQLPropertyExpr) { @@ -1305,18 +1420,21 @@ public class WallVisitorUtils { } } - if (visitor.isDenyTable(tableName)) { - boolean topStatement = isTopSelectStatement(x) || isTopUpdateStatement(x); - boolean isWhereOrHaving = isWhereOrHaving(x); + if (topStatementContext != null && (topStatementContext.fromSysSchema || topStatementContext.fromSysTable)) { + return true; + } - if (topStatement || !isWhereOrHaving) { + if (visitor.isDenyTable(tableName)) { + + if (isTopUpdateStatement(x) || isFirstSelectTableSource(x)) { if (topStatementContext != null) { topStatementContext.setFromSysTable(Boolean.TRUE); + clearViolation(visitor); } return false; } - boolean isTopNoneFrom = isTopSelectStatement(x); + boolean isTopNoneFrom = isTopNoneFromSelect(visitor, x); if (isTopNoneFrom) { return false; } @@ -1333,6 +1451,10 @@ public class WallVisitorUtils { visitor.addViolation(new IllegalSQLObjectViolation(errorCode, message, visitor.toSQL(x))); } + private static void clearViolation(WallVisitor visitor) { + visitor.getViolations().clear(); + } + public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) { if (x.getOperator() == SQLUnionOperator.MINUS && !visitor.getConfig().isMinusAllow()) { addViolation(visitor, ErrorCode.INTERSET_NOT_ALLOW, "minus not allow", x); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java index 5df6c66e7b..d3b43f1ec9 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java @@ -28,14 +28,19 @@ import com.alibaba.druid.wall.WallUtils; public class DoPrivilegedTest extends TestCase { public void test_0() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os FROM X")); + Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X")); + } + + public void test_0_0() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql("select * FROM X where version=@@version_compile_os")); } public void test_1() throws Exception { final WallConfig config = new WallConfig(); config.setDoPrivilegedAllow(true); - + WallProvider.doPrivileged(new PrivilegedAction() { + @Override public Object run() { Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config)); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java index b75ed54700..b7ab108f05 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java @@ -29,11 +29,12 @@ public class MySqlWallPermitFunctionTest extends TestCase { Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM \"mysql\".\"user\"")); Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM MYSQL.USER")); } - + public void test_permitTable_subquery() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a")); - Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a")); - Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a")); - Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a")); + Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a")); + Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a")); + Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a")); + Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a")); } + } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java index bd48b1b3bf..54395443da 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java @@ -19,8 +19,6 @@ import junit.framework.TestCase; import org.junit.Assert; -import com.alibaba.druid.wall.WallConfig; -import com.alibaba.druid.wall.WallUtils; import com.alibaba.druid.wall.spi.MySqlWallProvider; /** @@ -30,17 +28,19 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider; */ public class MySqlWallPermitVariantTest extends TestCase { + private String sql = "select * FROM X where id=1 or version=@@version_compile_os"; + public void test_allow() throws Exception { MySqlWallProvider provider = new MySqlWallProvider(); provider.getConfig().setVariantCheck(false); - - Assert.assertTrue(provider.checkValid("select @@version_compile_os FROM X")); + + Assert.assertTrue(provider.checkValid(sql)); } - + public void test_not_allow() throws Exception { MySqlWallProvider provider = new MySqlWallProvider(); provider.getConfig().setVariantCheck(true); - - Assert.assertFalse(provider.checkValid("select @@version_compile_os FROM X")); + + Assert.assertFalse(provider.checkValid(sql)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java index 5997686cc4..a653de0a12 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java @@ -24,24 +24,25 @@ import com.alibaba.druid.wall.WallUtils; public class MySqlWallTest extends TestCase { public void testWall() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM X where id=1 and 1!=1 union select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X")); Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os' FROM X")); - Assert.assertFalse(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM X where id=1 and 1!=1 union select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))")); + Assert.assertTrue(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))")); Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'")); - + Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X")); Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'")); Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns")); Assert.assertTrue(WallUtils.isValidateMySql("select 'information_schema.columns'")); - + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from mysql.user")); Assert.assertTrue(WallUtils.isValidateMySql("select 'mysql.user'")); - + Assert.assertFalse(WallUtils.isValidateMySql("select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'")); Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'")); - + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java index 05c6c71438..6ce4851285 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java @@ -34,9 +34,14 @@ public class MySqlWallTest19 extends TestCase { Assert.assertTrue(WallUtils.isValidateMySql(// "select @@basedir")); // } - + + public void test_true2() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(// + "select @@basedir FROM X")); // + } + public void test_false() throws Exception { Assert.assertFalse(WallUtils.isValidateMySql(// - "select @@basedir FROM X")); // + "select * FROM X where id=1 and dir=@@basedir")); // } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest57.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest57.java index a55cf2f95f..3891c2e784 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest57.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest57.java @@ -39,22 +39,31 @@ public class MySqlWallTest57 extends TestCase { Assert.assertEquals(0, provider.getTableStats().size()); } - + public void test_true_1() throws Exception { WallProvider provider = new MySqlWallProvider(); - + Assert.assertTrue(provider.checkValid(// - "SELECT @@version FROM DUAL")); - + "SELECT @@version FROM DUAL")); + Assert.assertEquals(1, provider.getTableStats().size()); } - + + public void test_true_2() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertTrue(provider.checkValid(// + "SELECT @@version FROM X")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); - + Assert.assertFalse(provider.checkValid(// - "SELECT @@version FROM X")); - + "SELECT * FROM X where id=1 and 1!=1 union select @@version")); + Assert.assertEquals(1, provider.getTableStats().size()); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest66.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest66.java index 288ff03c5d..b55421dc3b 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest66.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest66.java @@ -31,7 +31,7 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider; */ public class MySqlWallTest66 extends TestCase { - public void test_false() throws Exception { + public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); provider.getConfig().setSchemaCheck(true); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest71.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest71.java index 3eddec72d8..9a12c31cbf 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest71.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest71.java @@ -33,13 +33,24 @@ public class MySqlWallTest71 extends TestCase { public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); - + provider.getConfig().setCommentAllow(true); - Assert.assertFalse(provider.checkValid(// + Assert.assertTrue(provider.checkValid(// "update order_return set return_goods_money =0.00 ,return_other_money = 8--149.00, return_total_fee = ifnull(return_shipping,0)+ifnull(return_other_discount,0)+0.00--149.00-0.00,return_goods_amount=1,return_real_money=0.00 where id=1319")); Assert.assertEquals(1, provider.getTableStats().size()); } + public void test_false1() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + provider.getConfig().setCommentAllow(true); + + Assert.assertFalse(provider.checkValid(// + "select * from order_return where return_goods_money =0.00 ,return_other_money = 8--149.00, return_total_fee = ifnull(return_shipping,0)+ifnull(return_other_discount,0)+0.00--149.00-0.00,return_goods_amount=1,return_real_money=0.00")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java new file mode 100644 index 0000000000..0a98de39a3 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -0,0 +1,155 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest91 extends TestCase { + + private WallProvider initWallProvider() { + WallProvider provider = new MySqlWallProvider(); + + provider.getConfig().setUseAllow(true); + provider.getConfig().setStrictSyntaxCheck(false); + provider.getConfig().setMultiStatementAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); + provider.getConfig().setNoneBaseStatementAllow(true); + provider.getConfig().setSelectUnionCheck(false); + provider.getConfig().setSchemaCheck(true); + provider.getConfig().setLimitZeroAllow(true); + provider.getConfig().setCommentAllow(true); + + return provider; + } + + public void test_false() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT count(*) FROM i_user_commentary WHERE item_type = 7 AND item_id = 30 AND SLEEP(5) AND is_del=0"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false1() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT * FROM `group` WHERE group.nickname like '%' AND 8709=IF(((66+67)>222),SLEEP(5),8709) AND 'Ttyv' LIKE 'Ttyv%' OR group.fullname like '%' AND 8709=IF(((66+67)>222),SLEEP(5),8709) AND 'Ttyv' LIKE 'Ttyv%'"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false2() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT user.id,user.name FROM `user` WHERE user.name like '%' AND 7961=IF(((27+33)>159),SLEEP(5),7961) AND 'dewN' LIKE 'dewN%' AND user.activated = 1"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false3() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 "; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false4() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 "; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false5() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false6() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 "; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false7() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select sysuser0_.sysuser_id as sysuser1_163_, sysuser0_.sysuser_name as sysuser2_163_, sysuser0_.sysuser_loginname as sysuser3_163_, sysuser0_.sysuser_password as sysuser4_163_, sysuser0_.sysuser_mobilenum as sysuser5_163_, sysuser0_.sysuser_email as sysuser6_163_, sysuser0_.sysuser_phonenum as sysuser7_163_, sysuser0_.sysuser_createtime as sysuser8_163_, sysuser0_.sysuser_lastupdate as sysuser9_163_, sysuser0_.sysuser_status as sysuser10_163_, sysuser0_.sysuser_loginip as sysuser11_163_, sysuser0_.sysuser_interfacesn as sysuser12_163_, sysuser0_.customer_customer_id as customer13_163_, sysuser0_.role_role_id as role14_163_ from sysuser sysuser0_ where sysuser0_.sysuser_status=1 and sysuser0_.role_role_id=5 and sysuser0_.sysuser_loginname='sms_bftl2' and USER()=USER() and 'EYrc'='EYrc'"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_true() throws Exception { + WallProvider provider = initWallProvider(); + + { + String sql = "SELECT CONVERT(load_file(concat(@@datadir, 'sandbox', '/', 'ccp_application', '.frm')) USING utf8) AS source"; + Assert.assertTrue(provider.checkValid(sql)); + } + + { + String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from sys.KEY_COLUMN_USAGE c join sys.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'"; + Assert.assertTrue(provider.checkValid(sql)); + } + + { + String sql = "SELECT user_name(), @@MAX_PRECISION, is_member('db_owner'), permissions(), DatabasePropertyEx(db_name(), N'collation'), SERVERPROPERTY('IsFullTextInstalled'), schema_name()"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select col.name, col.column_id, st.name as DT_name, schema_name(st.schema_id) as DT_schema, col.max_length, col.precision, col.scale, bt.name as BT_name, col.collation_name, col.is_nullable, col.is_ansi_padded, col.is_rowguidcol, col.is_identity, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.seed_value) end, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.increment_value) end, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, convert(bit, ColumnProperty(col.object_id, col.name, N'IsIdNotForRepl')) as IsIdNotForRepl, col.is_replicated, col.is_non_sql_subscribed, col.is_merge_published, col.is_dts_replicated, col.rule_object_id, robj.name as Rul_name, schema_name(robj.schema_id) as Rul_schema, col.default_object_id, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, dobj.name as def_name, schema_name(dobj.schema_id) as def_schema, CONVERT(bit, case when (ftc.column_id is null) then 0 else 1 end) as is_FullTextCol, col_name(col.object_id, ftc.type_column_id) FT_type_column, ftc.language_id as FT_language_id, case when(cmc.column_id is null) then null else cmc.definition end as formular, case when(cmc.column_id is null) then null else cmc.is_persisted end as is_persisted, defCst.definition, COLUMNPROPERTY(col.object_id, col.name, 'IsDeterministic') as IsDeterministic, xmlcoll.name as xmlSchema_name, schema_name(xmlcoll.schema_id) as xmlSchema_schema, col.is_xml_document, col.is_sparse, col.is_column_set from sys.columns col left outer join sys.types st on st.user_type_id = col.user_type_id left outer join sys.types bt on bt.user_type_id = col.system_type_id left outer join sys.objects robj on robj.object_id = col.rule_object_id and robj.type = 'R' left outer join sys.objects dobj on dobj.object_id = col.default_object_id and dobj.type = 'D' left outer join sys.default_constraints defCst on defCst.parent_object_id = col.object_id and defCst.parent_column_id = col.column_id left outer join sys.identity_columns idc o"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `www_subject` WHERE subject like '哎%' or subject like '%' ORDER BY aid desc LIMIT 30 "; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT COUNT(*) FROM syscolumns WHERE id=OBJECT_ID(N'taobao_order') AND name='r3_billtype'"; + Assert.assertTrue(provider.checkValid(sql)); + } + + { + String sql = "select col.name, st.name as DT_name, case when (st.name in ('nchar', 'nvarchar') and (col.max_length > 0)) then col.max_length / 2 else col.max_length end, col.precision, col.scale, bt.name as BT_name, col.is_nullable, col.is_identity,col.is_rowguidcol, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, case when(cmc.column_id is null) then null else cmc.definition end as formular, col.collation_name, col.system_type_id from nowshop.sys.all_columns col left outer join nowshop.sys.types st on st.user_type_id = col.user_type_id left outer join nowshop.sys.types bt on bt.user_type_id = col.system_type_id left outer join nowshop.sys.identity_columns idc on idc.object_id = col.object_id and idc.column_id = col.column_id left outer join nowshop.sys.computed_columns cmc on cmc.object_id = col.object_id and cmc.column_id = col.column_id where col.object_id = object_id(N'nowshop.dbo.hr_shop') order by col.column_id"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''"; + Assert.assertTrue(provider.checkValid(sql)); + } + + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java index 7e97f3da8e..d00d5f2564 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java @@ -45,8 +45,13 @@ public class MySqlWallTest_var extends TestCase { "SELECT * FROM T WHERE @@SESSION.sql_mode = 'ANSI'")); // } - public void test_false_1() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql(// + public void test_true2() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(// "SELECT * FROM T WHERE @@sql_mode = 'ANSI'")); // } + + public void test_false_1() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "SELECT * FROM T WHERE @@basedir = 'ANSI'")); // + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java index 6b341b95b2..c4b39f090f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java @@ -28,17 +28,17 @@ public class OracleWallPermitTableTest extends TestCase { Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from tab")); Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.TAB")); Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.\"TAB\"")); - + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from all_users")); } - + public void test_permitTable_subquery() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from TAB) a")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from tab) a")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from SYS.TAB) a")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from SYS.\"TAB\") a")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from TAB) a")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from tab) a")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from SYS.TAB) a")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from SYS.\"TAB\") a")); } - + public void test_permitTable_join() throws Exception { Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, TAB")); Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, tab")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 1799c2071f..39506e3cd8 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils; /** * SQLServerWallPermitFunctionTest - * + * * @author RaymondXiu * @version 1.0, 2012-3-18 * @see @@ -33,59 +33,63 @@ public class SQLServerWallPermitFunctionTest extends TestCase { /** * @param name */ - public SQLServerWallPermitFunctionTest(String name) { + public SQLServerWallPermitFunctionTest(String name){ super(name); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#setUp() */ protected void setUp() throws Exception { super.setUp(); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#tearDown() */ protected void tearDown() throws Exception { super.tearDown(); } - + public void test01() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;")); + Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;")); } - + public final void test_sp_addsrvrolemenber() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); } - + public final void test_sp_helpdb() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master")); Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs")); } - + public final void test_sp_droplogin() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); } + public final void test_sp_addlogin() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); } - + public final void test_db_name() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME() FROM X")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0) FROM X; ")); } - + public final void test_host_name() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME() FROM X")); } - + /** * 测试权限结构 + * * @throws Exception */ public void test_is_srvrolemember() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’) FROM X;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’) FROM X;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’) FROM X;")); @@ -97,5 +101,4 @@ public class SQLServerWallPermitFunctionTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; ")); } - } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitObjectTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitObjectTest.java index 10f7b23de9..6a01e57805 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitObjectTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitObjectTest.java @@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils; /** * SQLServerWallPermitObjectTest - * + * * @author RaymondXiu * @version 1.0, 2012-3-18 * @see @@ -33,18 +33,20 @@ public class SQLServerWallPermitObjectTest extends TestCase { /** * @param name */ - public SQLServerWallPermitObjectTest(String name) { + public SQLServerWallPermitObjectTest(String name){ super(name); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#setUp() */ protected void setUp() throws Exception { super.setUp(); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#tearDown() */ protected void tearDown() throws Exception { @@ -52,10 +54,18 @@ public class SQLServerWallPermitObjectTest extends TestCase { } public void test_user() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user;")); + Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT user;")); } - + + public void test_user2() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT id from T where 1=1 and 1!=1 union select user;")); + } + public void test_system_user() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); + Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT system_user;")); + } + + public void test_system_user2() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT id from T where 1=1 and 1!=1 union select system_user;")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java index 721c3c5992..b956a56a35 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java @@ -23,22 +23,21 @@ import com.alibaba.druid.wall.WallUtils; /** * 这个场景测试访问SQLServer系统表 - * + * * @author RaymondXiu * @version 1.0, 2012-3-18 * @see */ public class SQLServerWallPermitTableTest extends TestCase { + public void test01() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysObjects")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysdatabases")); } - public void test03() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);")); } - -} \ No newline at end of file +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java index 00a7e6a7b9..3817916c03 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java @@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils; /** * SQLServerWallTest - * + * * @author RaymondXiu * @version 1.0, 2012-3-18 * @see @@ -33,29 +33,31 @@ public class SQLServerWallTest extends TestCase { /** * @param name */ - public SQLServerWallTest(String name) { + public SQLServerWallTest(String name){ super(name); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#setUp() */ protected void setUp() throws Exception { super.setUp(); } - /* (non-Javadoc) + /* + * (non-Javadoc) * @see junit.framework.TestCase#tearDown() */ protected void tearDown() throws Exception { super.tearDown(); } - + public void test_stuff() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT @@version")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from table where version = @@version")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT 1 — comment")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT /*comment*/1")); Assert.assertFalse(WallUtils.isValidateSqlServer("WAITFOR DELAY ’0:0:5′ ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;")); - } -} \ No newline at end of file + Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;")); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java new file mode 100644 index 0000000000..731a310cbd --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java @@ -0,0 +1,143 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.SQLServerWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class SQLServerWallTest_0 extends TestCase { + + private WallProvider initWallProvider() { + WallProvider provider = new SQLServerWallProvider(); + + provider.getConfig().setUseAllow(true); + provider.getConfig().setStrictSyntaxCheck(false); + provider.getConfig().setMultiStatementAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); + provider.getConfig().setNoneBaseStatementAllow(true); + provider.getConfig().setSelectUnionCheck(false); + provider.getConfig().setSchemaCheck(true); + provider.getConfig().setLimitZeroAllow(true); + provider.getConfig().setCommentAllow(true); + + return provider; + } + + public void test_false() { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT KL_ArticleContent,KL_ArticleTitle FROM dbo.KL_Article WHERE KL_ArticleId =13 And (Select Top 1 unicode(substring(isNull(cast(name as varchar(8000)),char(32)),7,1)) From (Select Top 9 [dbid],[name] From master..sysdatabases Order by [dbid] desc) T Order by [dbid]) between 105 and 105"; + Assert.assertFalse(provider.checkValid(sql)); + } + { + String sql = "SELECT KL_ArticleContent,KL_ArticleTitle FROM dbo.KL_Article WHERE KL_ArticleId =13 and (select unicode(substring(isNull(cast(db_name() as varchar(8000)),char(32)),1,1))) between 105 and 108"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_false1() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select OrderId,Order_Time,oResult,oState,show_Exp_Num,Is_Exp_Print,sel_Exp_Id,Order_Th,Th_Audit_Time,Th_Delay_Days from Pro_Order_List where OrderId='2012110125252' AND HOST_NAME()=HOST_NAME() AND 'kbwg'='kbwg'"; + Assert.assertFalse(provider.checkValid(sql)); + } + } + + public void test_true1() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select Fg.name as TableFg, dsp.name as TexImageFg, FtCat.name as FulltextCatalog, OBJECTPROPERTY(tbl.object_id, 'TableTextInRowLimit') as TextInrowLimit, OBJECTPROPERTY(tbl.object_id, 'IsIndexable'), user_name(tbl.principal_id) as DirectOwner, tbl.is_replicated, tbl.lock_escalation_desc from sys.tables tbl left outer join sys.data_spaces dsp on dsp.data_space_id = tbl.lob_data_space_id left outer join (sys.fulltext_indexes fti inner join sys.fulltext_catalogs FtCat on FtCat.fulltext_catalog_id = fti.fulltext_catalog_id ) on fti.object_id = tbl.object_id inner join (sys.indexes idx inner join sys.data_spaces Fg on (idx.index_id = 0 or idx.index_id = 1) and Fg.data_space_id = idx.data_space_id) on idx.object_id = tbl.object_id and (idx.index_id = 0 or idx.index_id = 1) where tbl.object_id = object_id(N'dbo.nqh_TelOrder') "; + Assert.assertTrue(provider.checkValid(sql)); + } + } + + public void test_true() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT 'Server[@Name=' + quotename(CAST(serverproperty(N'Servername') AS sysname),'''') + ']' + '/Collation[@Name=' + quotename(cl.name,'''') + ']' AS [Urn], cl.name AS [Name], CAST(COLLATIONPROPERTY(name, 'CodePage') AS int) AS [CodePage], CAST(COLLATIONPROPERTY(name, 'LCID') AS int) AS [LocaleID], CAST(COLLATIONPROPERTY(name, 'ComparisonStyle') AS int) AS [ComparisonStyle], cl.description AS [Description], CAST(COLLATIONPROPERTY(name, 'Version') AS int) AS [CollationVersion] FROM sys.fn_helpcollations() cl ORDER BY [Name] ASC"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT bp.Class_desc, bp.Permission_name, bp.Type, bp.Covering_permission_name, bp.Parent_class_desc, bp.Parent_covering_permission_name FROM sys.fn_builtin_permissions(null) as bp order by bp.class_desc"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select isExist = case when exists(select * from dbo.sysobjects where id = object_id ('SYS_LOG_2005')) then 1 else 0 end"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select length from syscolumns(nolock) where id = object_id('boat') and (name in ('boat_bag','skill_state'))"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from INFORMATION_SCHEMA.KEY_COLUMN_USAGE c join INFORMATION_SCHEMA.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_0 and SCHEMA_NAME(tbl.schema_id)=@_msparam_1)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_2 and SCHEMA_NAME(tbl.schema_id)=@_msparam_3)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_4 and SCHEMA_NAME(tbl.schema_id)=@_msparam_5)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_6 and SCHEMA_NAME(tbl.schema_id)=@_msparam_7)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_8 and SCHEMA_NAME(tbl.schema_id)=@_msparam_9)"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from sys.KEY_COLUMN_USAGE c join sys.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'"; + Assert.assertTrue(provider.checkValid(sql)); + } + + { + String sql = "SELECT user_name(), @@MAX_PRECISION, is_member('db_owner'), permissions(), DatabasePropertyEx(db_name(), N'collation'), SERVERPROPERTY('IsFullTextInstalled'), schema_name()"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select col.name, col.column_id, st.name as DT_name, schema_name(st.schema_id) as DT_schema, col.max_length, col.precision, col.scale, bt.name as BT_name, col.collation_name, col.is_nullable, col.is_ansi_padded, col.is_rowguidcol, col.is_identity, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.seed_value) end, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.increment_value) end, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, convert(bit, ColumnProperty(col.object_id, col.name, N'IsIdNotForRepl')) as IsIdNotForRepl, col.is_replicated, col.is_non_sql_subscribed, col.is_merge_published, col.is_dts_replicated, col.rule_object_id, robj.name as Rul_name, schema_name(robj.schema_id) as Rul_schema, col.default_object_id, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, dobj.name as def_name, schema_name(dobj.schema_id) as def_schema, CONVERT(bit, case when (ftc.column_id is null) then 0 else 1 end) as is_FullTextCol, col_name(col.object_id, ftc.type_column_id) FT_type_column, ftc.language_id as FT_language_id, case when(cmc.column_id is null) then null else cmc.definition end as formular, case when(cmc.column_id is null) then null else cmc.is_persisted end as is_persisted, defCst.definition, COLUMNPROPERTY(col.object_id, col.name, 'IsDeterministic') as IsDeterministic, xmlcoll.name as xmlSchema_name, schema_name(xmlcoll.schema_id) as xmlSchema_schema, col.is_xml_document, col.is_sparse, col.is_column_set from sys.columns col left outer join sys.types st on st.user_type_id = col.user_type_id left outer join sys.types bt on bt.user_type_id = col.system_type_id left outer join sys.objects robj on robj.object_id = col.rule_object_id and robj.type = 'R' left outer join sys.objects dobj on dobj.object_id = col.default_object_id and dobj.type = 'D' left outer join sys.default_constraints defCst on defCst.parent_object_id = col.object_id and defCst.parent_column_id = col.column_id left outer join sys.identity_columns idc o"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `www_subject` WHERE subject like '哎%' or subject like '%' ORDER BY aid desc LIMIT 30 "; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT COUNT(*) FROM syscolumns WHERE id=OBJECT_ID(N'taobao_order') AND name='r3_billtype'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "update master.dbo.dml_health_check set id=1"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "select col.name, st.name as DT_name, case when (st.name in ('nchar', 'nvarchar') and (col.max_length > 0)) then col.max_length / 2 else col.max_length end, col.precision, col.scale, bt.name as BT_name, col.is_nullable, col.is_identity,col.is_rowguidcol, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, case when(cmc.column_id is null) then null else cmc.definition end as formular, col.collation_name, col.system_type_id from nowshop.sys.all_columns col left outer join nowshop.sys.types st on st.user_type_id = col.user_type_id left outer join nowshop.sys.types bt on bt.user_type_id = col.system_type_id left outer join nowshop.sys.identity_columns idc on idc.object_id = col.object_id and idc.column_id = col.column_id left outer join nowshop.sys.computed_columns cmc on cmc.object_id = col.object_id and cmc.column_id = col.column_id where col.object_id = object_id(N'nowshop.dbo.hr_shop') order by col.column_id"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "update dbo.dml_health_check set name='123' where id=OBJECT_ID(N'taobao_order')"; + Assert.assertFalse(provider.checkValid(sql)); + } + { + String sql = "select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''"; + Assert.assertTrue(provider.checkValid(sql)); + } + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java index 2268b9bee5..eb10e13b51 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java @@ -22,18 +22,20 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; /** - * * @author wenshao - * */ public class WallDeleteWhereTest extends TestCase { - private String sql = "DELETE FROM T WHERE 1 = 1"; + + private String sql = "DELETE FROM T WHERE 1 = 1"; + private String sql2 = "DELETE FROM T WHERE id = 0 and 1 = 1"; public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql(sql)); + Assert.assertTrue(WallUtils.isValidateMySql(sql)); + Assert.assertFalse(WallUtils.isValidateMySql(sql2)); } - + public void testORACLE() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle(sql)); + Assert.assertTrue(WallUtils.isValidateOracle(sql)); + Assert.assertFalse(WallUtils.isValidateOracle(sql2)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateTest3.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateTest3.java index 2a8b872b64..0e2ffcd86c 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateTest3.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateTest3.java @@ -24,24 +24,27 @@ import com.alibaba.druid.wall.WallUtils; /** * 这个场景，检测 + * * @author wenshao - * */ public class WallUpdateTest3 extends TestCase { - private String sql = "UPDATE T_USER SET FNAME = ? WHERE 1 = 1"; - + + private String sql = "UPDATE T_USER SET FNAME = ? WHERE 1 = 1"; + private String sql2 = "UPDATE T_USER SET FNAME = ? WHERE id = 1 or1 = 1"; + private WallConfig config = new WallConfig(); - + protected void setUp() throws Exception { config.setUpdateAllow(true); } public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql2, config)); } - + public void testORACLE() throws Exception { - - Assert.assertFalse(WallUtils.isValidateOracle(sql, config)); + Assert.assertTrue(WallUtils.isValidateOracle(sql, config)); + Assert.assertFalse(WallUtils.isValidateOracle(sql2, config)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java index 21e875e82e..6ab08fc340 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java @@ -23,17 +23,22 @@ import com.alibaba.druid.wall.WallUtils; /** * 这个场景，检测可疑的Having条件 + * * @author wenshao - * */ public class WallUpdateWhereTest extends TestCase { - private String sql = "UPDATE T SET F1 = 0 WHERE 1 = 1"; + + private String sql = "UPDATE T SET F1 = 0 WHERE 1 = 1"; + private String sql2 = "UPDATE T SET F1 = 0 WHERE id=0 and 1 = 1"; public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql(sql)); + Assert.assertTrue(WallUtils.isValidateMySql(sql)); + Assert.assertFalse(WallUtils.isValidateMySql(sql2)); } - + public void testORACLE() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle(sql)); + Assert.assertTrue(WallUtils.isValidateOracle(sql)); + Assert.assertFalse(WallUtils.isValidateOracle(sql2)); } + }