Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

sql wall visitor

Browse Source
This commit is contained in:
kiki
2013-05-28 19:26:34 +08:00
parent b9e03143a7
commit 1ce9d5c62c
1 changed files with 7 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+7 -18
View File
@@ -209,19 +209,14 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x);
if (!isTop) {
boolean allow = true;
if (isDeny(varName)) {
if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) {
allow = false;
}
if (allow) {
if (WallVisitorUtils.isWhereOrHaving(x)) {
allow = false;
}
}
if (!allow) {
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : "
+ x.getName(), toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY,
"variable not allow : " + x.getName(),
toSQL(x)));
}
}
}
@@ -260,12 +255,12 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
return false;
}
public boolean isDeny(String varName) {
if (varName.startsWith("@@")) {
varName = varName.substring(2);
}
return config.getDenyVariants().contains(varName);
}
@@ -279,16 +274,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x);
if (!isTop) {
boolean allow = true;
if (isDeny(varName)) {
if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) {
allow = false;
}
if (allow) {
if (WallVisitorUtils.isWhereOrHaving(x)) {
allow = false;
}
}
if (!allow) {
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : "
+ x.getName(), toSQL(x)));