Merge remote-tracking branch 'upstream/master'

src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java

@@ -28,14 +28,19 @@ import com.alibaba.druid.wall.WallUtils;
 public class DoPrivilegedTest extends TestCase {
 
     public void test_0() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os  FROM X"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X"));
+    }
+
+    public void test_0_0() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select * FROM X where version=@@version_compile_os"));
     }
 
     public void test_1() throws Exception {
         final WallConfig config = new WallConfig();
         config.setDoPrivilegedAllow(true);
-        
+
         WallProvider.doPrivileged(new PrivilegedAction<Object>() {
+
             @Override
             public Object run() {
                 Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config));

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java

@@ -29,11 +29,12 @@ public class MySqlWallPermitFunctionTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM \"mysql\".\"user\""));
         Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM MYSQL.USER"));
     }
-    
+
     public void test_permitTable_subquery() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a"));
-        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a"));
-        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a"));
-        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a"));
     }
+
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java

@@ -19,8 +19,6 @@ import junit.framework.TestCase;
 
 import org.junit.Assert;
 
-import com.alibaba.druid.wall.WallConfig;
-import com.alibaba.druid.wall.WallUtils;
 import com.alibaba.druid.wall.spi.MySqlWallProvider;
 
 /**
@@ -30,17 +28,19 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
  */
 public class MySqlWallPermitVariantTest extends TestCase {
 
+    private String sql = "select * FROM X where id=1 or version=@@version_compile_os";
+
     public void test_allow() throws Exception {
         MySqlWallProvider provider = new MySqlWallProvider();
         provider.getConfig().setVariantCheck(false);
-        
-        Assert.assertTrue(provider.checkValid("select @@version_compile_os FROM X"));
+
+        Assert.assertTrue(provider.checkValid(sql));
     }
-    
+
     public void test_not_allow() throws Exception {
         MySqlWallProvider provider = new MySqlWallProvider();
         provider.getConfig().setVariantCheck(true);
-        
-        Assert.assertFalse(provider.checkValid("select @@version_compile_os FROM X"));
+
+        Assert.assertFalse(provider.checkValid(sql));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java

@@ -24,24 +24,25 @@ import com.alibaba.druid.wall.WallUtils;
 public class MySqlWallTest extends TestCase {
 
     public void testWall() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM X where id=1 and 1!=1 union select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X"));
         Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os' FROM X"));
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM X where id=1 and 1!=1 union select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'"));
-        
+
         Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'"));
 
         Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'information_schema.columns'"));
-        
+
         Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from mysql.user"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'mysql.user'"));
-        
+
         Assert.assertFalse(WallUtils.isValidateMySql("select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'"));
-        
+
         Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java

@@ -34,9 +34,14 @@ public class MySqlWallTest19 extends TestCase {
         Assert.assertTrue(WallUtils.isValidateMySql(//
         "select @@basedir")); //
     }
-    
+
+    public void test_true2() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(//
+        "select @@basedir FROM X")); //
+    }
+
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidateMySql(//
-                "select @@basedir FROM X")); //
+        "select * FROM X where id=1 and dir=@@basedir")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest57.java

@@ -39,22 +39,31 @@ public class MySqlWallTest57 extends TestCase {
 
         Assert.assertEquals(0, provider.getTableStats().size());
     }
-    
+
     public void test_true_1() throws Exception {
         WallProvider provider = new MySqlWallProvider();
-        
+
         Assert.assertTrue(provider.checkValid(//
-                "SELECT @@version FROM DUAL"));
-        
+        "SELECT @@version FROM DUAL"));
+
         Assert.assertEquals(1, provider.getTableStats().size());
     }
-    
+
+    public void test_true_2() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid(//
+        "SELECT @@version FROM X"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
     public void test_false() throws Exception {
         WallProvider provider = new MySqlWallProvider();
-        
+
         Assert.assertFalse(provider.checkValid(//
-                "SELECT @@version FROM X"));
-        
+        "SELECT * FROM X where id=1 and 1!=1 union select @@version"));
+
         Assert.assertEquals(1, provider.getTableStats().size());
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest66.java

@@ -31,7 +31,7 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
  */
 public class MySqlWallTest66 extends TestCase {
 
-    public void test_false() throws Exception {
+    public void test_true() throws Exception {
         WallProvider provider = new MySqlWallProvider();
         provider.getConfig().setSchemaCheck(true);
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest71.java

@@ -33,13 +33,24 @@ public class MySqlWallTest71 extends TestCase {
 
     public void test_false() throws Exception {
         WallProvider provider = new MySqlWallProvider();
-        
+
         provider.getConfig().setCommentAllow(true);
 
-        Assert.assertFalse(provider.checkValid(//
+        Assert.assertTrue(provider.checkValid(//
         "update order_return set return_goods_money =0.00 ,return_other_money = 8--149.00, return_total_fee = ifnull(return_shipping,0)+ifnull(return_other_discount,0)+0.00--149.00-0.00,return_goods_amount=1,return_real_money=0.00 where id=1319"));
 
         Assert.assertEquals(1, provider.getTableStats().size());
     }
 
+    public void test_false1() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        provider.getConfig().setCommentAllow(true);
+
+        Assert.assertFalse(provider.checkValid(//
+        "select * from order_return where return_goods_money =0.00 ,return_other_money = 8--149.00, return_total_fee = ifnull(return_shipping,0)+ifnull(return_other_discount,0)+0.00--149.00-0.00,return_goods_amount=1,return_real_money=0.00"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java

@@ -0,0 +1,155 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest91 extends TestCase {
+
+    private WallProvider initWallProvider() {
+        WallProvider provider = new MySqlWallProvider();
+
+        provider.getConfig().setUseAllow(true);
+        provider.getConfig().setStrictSyntaxCheck(false);
+        provider.getConfig().setMultiStatementAllow(true);
+        provider.getConfig().setConditionAndAlwayTrueAllow(true);
+        provider.getConfig().setNoneBaseStatementAllow(true);
+        provider.getConfig().setSelectUnionCheck(false);
+        provider.getConfig().setSchemaCheck(true);
+        provider.getConfig().setLimitZeroAllow(true);
+        provider.getConfig().setCommentAllow(true);
+
+        return provider;
+    }
+
+    public void test_false() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT count(*) FROM i_user_commentary WHERE item_type = 7 AND item_id = 30 AND SLEEP(5) AND is_del=0";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false1() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT * FROM `group` WHERE group.nickname like '%' AND 8709=IF(((66+67)>222),SLEEP(5),8709) AND 'Ttyv' LIKE 'Ttyv%' OR group.fullname like '%' AND 8709=IF(((66+67)>222),SLEEP(5),8709) AND 'Ttyv' LIKE 'Ttyv%'";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false2() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT user.id,user.name FROM `user` WHERE user.name like '%' AND 7961=IF(((27+33)>159),SLEEP(5),7961) AND 'dewN' LIKE 'dewN%' AND user.activated = 1";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false3() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 ";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false4() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 ";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false5() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false6() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 ";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false7() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "select sysuser0_.sysuser_id as sysuser1_163_, sysuser0_.sysuser_name as sysuser2_163_, sysuser0_.sysuser_loginname as sysuser3_163_, sysuser0_.sysuser_password as sysuser4_163_, sysuser0_.sysuser_mobilenum as sysuser5_163_, sysuser0_.sysuser_email as sysuser6_163_, sysuser0_.sysuser_phonenum as sysuser7_163_, sysuser0_.sysuser_createtime as sysuser8_163_, sysuser0_.sysuser_lastupdate as sysuser9_163_, sysuser0_.sysuser_status as sysuser10_163_, sysuser0_.sysuser_loginip as sysuser11_163_, sysuser0_.sysuser_interfacesn as sysuser12_163_, sysuser0_.customer_customer_id as customer13_163_, sysuser0_.role_role_id as role14_163_ from sysuser sysuser0_ where sysuser0_.sysuser_status=1 and sysuser0_.role_role_id=5 and sysuser0_.sysuser_loginname='sms_bftl2' and USER()=USER() and 'EYrc'='EYrc'";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_true() throws Exception {
+        WallProvider provider = initWallProvider();
+
+        {
+            String sql = "SELECT CONVERT(load_file(concat(@@datadir, 'sandbox', '/', 'ccp_application', '.frm')) USING utf8) AS source";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+
+        {
+            String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from sys.KEY_COLUMN_USAGE c join sys.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+
+        {
+            String sql = "SELECT user_name(), @@MAX_PRECISION, is_member('db_owner'), permissions(), DatabasePropertyEx(db_name(), N'collation'), SERVERPROPERTY('IsFullTextInstalled'), schema_name()";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select col.name, col.column_id, st.name as DT_name, schema_name(st.schema_id) as DT_schema, col.max_length, col.precision, col.scale, bt.name as BT_name, col.collation_name, col.is_nullable, col.is_ansi_padded, col.is_rowguidcol, col.is_identity, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.seed_value) end, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.increment_value) end, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, convert(bit, ColumnProperty(col.object_id, col.name, N'IsIdNotForRepl')) as IsIdNotForRepl, col.is_replicated, col.is_non_sql_subscribed, col.is_merge_published, col.is_dts_replicated, col.rule_object_id, robj.name as Rul_name, schema_name(robj.schema_id) as Rul_schema, col.default_object_id, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, dobj.name as def_name, schema_name(dobj.schema_id) as def_schema, CONVERT(bit, case when (ftc.column_id is null) then 0 else 1 end) as is_FullTextCol, col_name(col.object_id, ftc.type_column_id) FT_type_column, ftc.language_id as FT_language_id, case when(cmc.column_id is null) then null else cmc.definition end as formular, case when(cmc.column_id is null) then null else cmc.is_persisted end as is_persisted, defCst.definition, COLUMNPROPERTY(col.object_id, col.name, 'IsDeterministic') as IsDeterministic, xmlcoll.name as xmlSchema_name, schema_name(xmlcoll.schema_id) as xmlSchema_schema, col.is_xml_document, col.is_sparse, col.is_column_set from sys.columns col left outer join sys.types st on st.user_type_id = col.user_type_id left outer join sys.types bt on bt.user_type_id = col.system_type_id left outer join sys.objects robj on robj.object_id = col.rule_object_id and robj.type = 'R' left outer join sys.objects dobj on dobj.object_id = col.default_object_id and dobj.type = 'D' left outer join sys.default_constraints defCst on defCst.parent_object_id = col.object_id and defCst.parent_column_id = col.column_id left outer join sys.identity_columns idc o";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT * FROM `www_subject` WHERE subject like '哎%' or subject like '%' ORDER BY aid desc LIMIT 30 ";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT COUNT(*) FROM syscolumns WHERE id=OBJECT_ID(N'taobao_order') AND name='r3_billtype'";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+
+        {
+            String sql = "select col.name, st.name as DT_name, case when (st.name in ('nchar', 'nvarchar') and (col.max_length > 0)) then col.max_length / 2 else col.max_length end, col.precision, col.scale, bt.name as BT_name, col.is_nullable, col.is_identity,col.is_rowguidcol, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, case when(cmc.column_id is null) then null else cmc.definition end as formular, col.collation_name, col.system_type_id from nowshop.sys.all_columns col left outer join nowshop.sys.types st on st.user_type_id = col.user_type_id left outer join nowshop.sys.types bt on bt.user_type_id = col.system_type_id left outer join nowshop.sys.identity_columns idc on idc.object_id = col.object_id and idc.column_id = col.column_id left outer join nowshop.sys.computed_columns cmc on cmc.object_id = col.object_id and cmc.column_id = col.column_id where col.object_id = object_id(N'nowshop.dbo.hr_shop') order by col.column_id";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java

@@ -45,8 +45,13 @@ public class MySqlWallTest_var extends TestCase {
         "SELECT * FROM T WHERE @@SESSION.sql_mode = 'ANSI'")); //
     }
 
-    public void test_false_1() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(//
+    public void test_true2() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(//
         "SELECT * FROM T WHERE @@sql_mode = 'ANSI'")); //
     }
+
+    public void test_false_1() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(//
+        "SELECT * FROM T WHERE @@basedir = 'ANSI'")); //
+    }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java

@@ -28,17 +28,17 @@ public class OracleWallPermitTableTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from tab"));
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.TAB"));
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.\"TAB\""));
-        
+
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from all_users"));
     }
-    
+
     public void test_permitTable_subquery() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from TAB) a"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from tab) a"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from SYS.TAB) a"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from(select * from SYS.\"TAB\") a"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from TAB) a"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from tab) a"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from SYS.TAB) a"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from(select * from SYS.\"TAB\") a"));
     }
-    
+
     public void test_permitTable_join() throws Exception {
         Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, TAB"));
         Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, tab"));

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java

@@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * SQLServerWallPermitFunctionTest
- *
+ * 
  * @author RaymondXiu
  * @version 1.0, 2012-3-18
  * @see
@@ -33,59 +33,63 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
     /**
      * @param name
      */
-    public SQLServerWallPermitFunctionTest(String name) {
+    public SQLServerWallPermitFunctionTest(String name){
         super(name);
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#setUp()
      */
     protected void setUp() throws Exception {
         super.setUp();
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#tearDown()
      */
     protected void tearDown() throws Exception {
         super.tearDown();
     }
-    
+
     public void test01() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;"));
+        Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;"));
     }
-    
+
     public final void test_sp_addsrvrolemenber() throws Exception {
-    	Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin"));
     }
-    
+
     public final void test_sp_helpdb() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs"));
     }
-    
+
     public final void test_sp_droplogin() throws Exception {
-    	Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;"));
     }
+
     public final void test_sp_addlogin() throws Exception {
-    	Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; "));
     }
-    
+
     public final void test_db_name() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME() FROM X"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0) FROM X; "));
     }
-    
+
     public final void test_host_name() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME() FROM X"));
     }
-    
+
     /**
      * 测试权限结构
+     * 
      * @throws Exception
      */
     public void test_is_srvrolemember() throws Exception {
-    	Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’) FROM X;"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’) FROM X;"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’) FROM X;"));
@@ -97,5 +101,4 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; "));
     }
 
-
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitObjectTest.java

@@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * SQLServerWallPermitObjectTest
- *
+ * 
  * @author RaymondXiu
  * @version 1.0, 2012-3-18
  * @see
@@ -33,18 +33,20 @@ public class SQLServerWallPermitObjectTest extends TestCase {
     /**
      * @param name
      */
-    public SQLServerWallPermitObjectTest(String name) {
+    public SQLServerWallPermitObjectTest(String name){
         super(name);
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#setUp()
      */
     protected void setUp() throws Exception {
         super.setUp();
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#tearDown()
      */
     protected void tearDown() throws Exception {
@@ -52,10 +54,18 @@ public class SQLServerWallPermitObjectTest extends TestCase {
     }
 
     public void test_user() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user;"));
+        Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT user;"));
     }
-    
+
+    public void test_user2() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT id from T where 1=1 and 1!=1 union select user;"));
+    }
+
     public void test_system_user() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;"));
+        Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT system_user;"));
+    }
+
+    public void test_system_user2() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT id from T where 1=1 and 1!=1 union select system_user;"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java

@@ -23,22 +23,21 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * 这个场景测试访问SQLServer系统表
- *
+ * 
  * @author RaymondXiu
  * @version 1.0, 2012-3-18
  * @see
  */
 public class SQLServerWallPermitTableTest extends TestCase {
+
     public void test01() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysObjects"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysdatabases"));
     }
-    
 
     public void test03() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ "));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));
     }
-    
 
-}
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java

@@ -23,7 +23,7 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * SQLServerWallTest
- *
+ * 
  * @author RaymondXiu
  * @version 1.0, 2012-3-18
  * @see
@@ -33,29 +33,31 @@ public class SQLServerWallTest extends TestCase {
     /**
      * @param name
      */
-    public SQLServerWallTest(String name) {
+    public SQLServerWallTest(String name){
         super(name);
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#setUp()
      */
     protected void setUp() throws Exception {
         super.setUp();
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
      * @see junit.framework.TestCase#tearDown()
      */
     protected void tearDown() throws Exception {
         super.tearDown();
     }
-    
+
     public void test_stuff() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT @@version"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from table where version = @@version"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT 1 — comment"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT /*comment*/1"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("WAITFOR DELAY ’0:0:5′ "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;"));                  
-    }    
-}
+        Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;"));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java

@@ -0,0 +1,143 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.SQLServerWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class SQLServerWallTest_0 extends TestCase {
+
+    private WallProvider initWallProvider() {
+        WallProvider provider = new SQLServerWallProvider();
+
+        provider.getConfig().setUseAllow(true);
+        provider.getConfig().setStrictSyntaxCheck(false);
+        provider.getConfig().setMultiStatementAllow(true);
+        provider.getConfig().setConditionAndAlwayTrueAllow(true);
+        provider.getConfig().setNoneBaseStatementAllow(true);
+        provider.getConfig().setSelectUnionCheck(false);
+        provider.getConfig().setSchemaCheck(true);
+        provider.getConfig().setLimitZeroAllow(true);
+        provider.getConfig().setCommentAllow(true);
+
+        return provider;
+    }
+
+    public void test_false() {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT KL_ArticleContent,KL_ArticleTitle FROM dbo.KL_Article WHERE KL_ArticleId =13 And (Select Top 1 unicode(substring(isNull(cast(name as varchar(8000)),char(32)),7,1)) From (Select Top 9 [dbid],[name] From master..sysdatabases Order by [dbid] desc) T Order by [dbid]) between 105 and 105";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT KL_ArticleContent,KL_ArticleTitle FROM dbo.KL_Article WHERE KL_ArticleId =13 and (select unicode(substring(isNull(cast(db_name() as varchar(8000)),char(32)),1,1))) between 105 and 108";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_false1() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "select OrderId,Order_Time,oResult,oState,show_Exp_Num,Is_Exp_Print,sel_Exp_Id,Order_Th,Th_Audit_Time,Th_Delay_Days from Pro_Order_List where OrderId='2012110125252' AND HOST_NAME()=HOST_NAME() AND 'kbwg'='kbwg'";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+    }
+
+    public void test_true1() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "select Fg.name as TableFg, dsp.name as TexImageFg, FtCat.name as FulltextCatalog, OBJECTPROPERTY(tbl.object_id, 'TableTextInRowLimit') as TextInrowLimit, OBJECTPROPERTY(tbl.object_id, 'IsIndexable'), user_name(tbl.principal_id) as DirectOwner, tbl.is_replicated, tbl.lock_escalation_desc from sys.tables tbl left outer join sys.data_spaces dsp on dsp.data_space_id = tbl.lob_data_space_id left outer join (sys.fulltext_indexes fti inner join sys.fulltext_catalogs FtCat on FtCat.fulltext_catalog_id = fti.fulltext_catalog_id ) on fti.object_id = tbl.object_id inner join (sys.indexes idx inner join sys.data_spaces Fg on (idx.index_id = 0 or idx.index_id = 1) and Fg.data_space_id = idx.data_space_id) on idx.object_id = tbl.object_id and (idx.index_id = 0 or idx.index_id = 1) where tbl.object_id = object_id(N'dbo.nqh_TelOrder') ";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+    }
+
+    public void test_true() throws Exception {
+        WallProvider provider = initWallProvider();
+        {
+            String sql = "SELECT 'Server[@Name=' + quotename(CAST(serverproperty(N'Servername') AS sysname),'''') + ']' + '/Collation[@Name=' + quotename(cl.name,'''') + ']' AS [Urn], cl.name AS [Name], CAST(COLLATIONPROPERTY(name, 'CodePage') AS int) AS [CodePage], CAST(COLLATIONPROPERTY(name, 'LCID') AS int) AS [LocaleID], CAST(COLLATIONPROPERTY(name, 'ComparisonStyle') AS int) AS [ComparisonStyle], cl.description AS [Description], CAST(COLLATIONPROPERTY(name, 'Version') AS int) AS [CollationVersion] FROM sys.fn_helpcollations() cl ORDER BY [Name] ASC";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT bp.Class_desc, bp.Permission_name, bp.Type, bp.Covering_permission_name, bp.Parent_class_desc, bp.Parent_covering_permission_name FROM sys.fn_builtin_permissions(null) as bp order by bp.class_desc";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select isExist = case when exists(select * from dbo.sysobjects where id = object_id ('SYS_LOG_2005')) then 1 else 0 end";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select length from syscolumns(nolock) where id = object_id('boat') and (name in ('boat_bag','skill_state'))";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from INFORMATION_SCHEMA.KEY_COLUMN_USAGE c join INFORMATION_SCHEMA.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_0 and SCHEMA_NAME(tbl.schema_id)=@_msparam_1)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_2 and SCHEMA_NAME(tbl.schema_id)=@_msparam_3)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_4 and SCHEMA_NAME(tbl.schema_id)=@_msparam_5)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_6 and SCHEMA_NAME(tbl.schema_id)=@_msparam_7)INSERT INTO tempdep SELECT tbl.object_id AS [ID], tbl.name AS [Name], SCHEMA_NAME(tbl.schema_id) AS [Schema], db_name(), 3 FROM sys.tables AS tbl WHERE (tbl.name=@_msparam_8 and SCHEMA_NAME(tbl.schema_id)=@_msparam_9)";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select c.COLUMN_NAME, COLUMNPROPERTY(OBJECT_ID(c.TABLE_SCHEMA + '.' + c.TABLE_NAME), c.COLUMN_NAME, 'IsIdentity') from sys.KEY_COLUMN_USAGE c join sys.TABLE_CONSTRAINTS p on p.CONSTRAINT_NAME = c.CONSTRAINT_NAME where c.TABLE_NAME = @p1 and c.TABLE_SCHEMA = @p2 and p.TABLE_SCHEMA = @p2 and p.CONSTRAINT_TYPE = 'PRIMARY KEY'";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+
+        {
+            String sql = "SELECT user_name(), @@MAX_PRECISION, is_member('db_owner'), permissions(), DatabasePropertyEx(db_name(), N'collation'), SERVERPROPERTY('IsFullTextInstalled'), schema_name()";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select col.name, col.column_id, st.name as DT_name, schema_name(st.schema_id) as DT_schema, col.max_length, col.precision, col.scale, bt.name as BT_name, col.collation_name, col.is_nullable, col.is_ansi_padded, col.is_rowguidcol, col.is_identity, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.seed_value) end, case when(idc.column_id is null) then null else CONVERT(nvarchar(40), idc.increment_value) end, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, convert(bit, ColumnProperty(col.object_id, col.name, N'IsIdNotForRepl')) as IsIdNotForRepl, col.is_replicated, col.is_non_sql_subscribed, col.is_merge_published, col.is_dts_replicated, col.rule_object_id, robj.name as Rul_name, schema_name(robj.schema_id) as Rul_schema, col.default_object_id, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, dobj.name as def_name, schema_name(dobj.schema_id) as def_schema, CONVERT(bit, case when (ftc.column_id is null) then 0 else 1 end) as is_FullTextCol, col_name(col.object_id, ftc.type_column_id) FT_type_column, ftc.language_id as FT_language_id, case when(cmc.column_id is null) then null else cmc.definition end as formular, case when(cmc.column_id is null) then null else cmc.is_persisted end as is_persisted, defCst.definition, COLUMNPROPERTY(col.object_id, col.name, 'IsDeterministic') as IsDeterministic, xmlcoll.name as xmlSchema_name, schema_name(xmlcoll.schema_id) as xmlSchema_schema, col.is_xml_document, col.is_sparse, col.is_column_set from sys.columns col left outer join sys.types st on st.user_type_id = col.user_type_id left outer join sys.types bt on bt.user_type_id = col.system_type_id left outer join sys.objects robj on robj.object_id = col.rule_object_id and robj.type = 'R' left outer join sys.objects dobj on dobj.object_id = col.default_object_id and dobj.type = 'D' left outer join sys.default_constraints defCst on defCst.parent_object_id = col.object_id and defCst.parent_column_id = col.column_id left outer join sys.identity_columns idc o";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT * FROM `www_subject` WHERE subject like '哎%' or subject like '%' ORDER BY aid desc LIMIT 30 ";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "SELECT COUNT(*) FROM syscolumns WHERE id=OBJECT_ID(N'taobao_order') AND name='r3_billtype'";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "update master.dbo.dml_health_check set id=1";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "select col.name, st.name as DT_name, case when (st.name in ('nchar', 'nvarchar') and (col.max_length > 0)) then col.max_length / 2 else col.max_length end, col.precision, col.scale, bt.name as BT_name, col.is_nullable, col.is_identity,col.is_rowguidcol, OBJECTPROPERTY(col.default_object_id, N'IsDefaultCnst') as is_defcnst, CONVERT(bit, case when(cmc.column_id is null) then 0 else 1 end) as is_computed, case when(cmc.column_id is null) then null else cmc.definition end as formular, col.collation_name, col.system_type_id from nowshop.sys.all_columns col left outer join nowshop.sys.types st on st.user_type_id = col.user_type_id left outer join nowshop.sys.types bt on bt.user_type_id = col.system_type_id left outer join nowshop.sys.identity_columns idc on idc.object_id = col.object_id and idc.column_id = col.column_id left outer join nowshop.sys.computed_columns cmc on cmc.object_id = col.object_id and cmc.column_id = col.column_id where col.object_id = object_id(N'nowshop.dbo.hr_shop') order by col.column_id";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+        {
+            String sql = "update dbo.dml_health_check set name='123' where id=OBJECT_ID(N'taobao_order')";
+            Assert.assertFalse(provider.checkValid(sql));
+        }
+        {
+            String sql = "select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''";
+            Assert.assertTrue(provider.checkValid(sql));
+        }
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java

@@ -22,18 +22,20 @@ import org.junit.Assert;
 import com.alibaba.druid.wall.WallUtils;
 
 /**
- * 
  * @author wenshao
- *
  */
 public class WallDeleteWhereTest extends TestCase {
-    private String sql = "DELETE FROM T WHERE 1 = 1";
+
+    private String sql  = "DELETE FROM T WHERE 1 = 1";
+    private String sql2 = "DELETE FROM T WHERE id = 0 and 1 = 1";
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+        Assert.assertTrue(WallUtils.isValidateMySql(sql));
+        Assert.assertFalse(WallUtils.isValidateMySql(sql2));
     }
-    
+
     public void testORACLE() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+        Assert.assertTrue(WallUtils.isValidateOracle(sql));
+        Assert.assertFalse(WallUtils.isValidateOracle(sql2));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateTest3.java

@@ -24,24 +24,27 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * 这个场景，检测
+ * 
  * @author wenshao
- *
  */
 public class WallUpdateTest3 extends TestCase {
-    private String sql = "UPDATE T_USER SET FNAME = ? WHERE 1 = 1";
-    
+
+    private String     sql    = "UPDATE T_USER SET FNAME = ? WHERE 1 = 1";
+    private String     sql2   = "UPDATE T_USER SET FNAME = ? WHERE id = 1 or1 = 1";
+
     private WallConfig config = new WallConfig();
-    
+
     protected void setUp() throws Exception {
         config.setUpdateAllow(true);
     }
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+        Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
+        Assert.assertFalse(WallUtils.isValidateMySql(sql2, config));
     }
-    
+
     public void testORACLE() throws Exception {
-        
-        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+        Assert.assertTrue(WallUtils.isValidateOracle(sql, config));
+        Assert.assertFalse(WallUtils.isValidateOracle(sql2, config));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java

@@ -23,17 +23,22 @@ import com.alibaba.druid.wall.WallUtils;
 
 /**
  * 这个场景，检测可疑的Having条件
+ * 
  * @author wenshao
- *
  */
 public class WallUpdateWhereTest extends TestCase {
-    private String sql = "UPDATE T SET F1 = 0 WHERE 1 = 1";
+
+    private String sql  = "UPDATE T SET F1 = 0 WHERE 1 = 1";
+    private String sql2 = "UPDATE T SET F1 = 0 WHERE id=0 and 1 = 1";
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+        Assert.assertTrue(WallUtils.isValidateMySql(sql));
+        Assert.assertFalse(WallUtils.isValidateMySql(sql2));
     }
-    
+
     public void testORACLE() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+        Assert.assertTrue(WallUtils.isValidateOracle(sql));
+        Assert.assertFalse(WallUtils.isValidateOracle(sql2));
     }
+
 }