From 1e35c47986b0bffde090958b68980d679f63a01b Mon Sep 17 00:00:00 2001
From: wenshao <szujobs@gmail.com>
Date: Mon, 1 Apr 2013 20:52:37 +0800
Subject: [PATCH] improve wall filter

---
 .../ast/statement/SQLAlterTableStatement.java |  1 -
 .../com/alibaba/druid/wall/WallConfig.java    | 18 +++++++++
 .../druid/wall/spi/WallVisitorUtils.java      | 37 +++++++++++--------
 3 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/src/main/java/com/alibaba/druid/sql/ast/statement/SQLAlterTableStatement.java b/src/main/java/com/alibaba/druid/sql/ast/statement/SQLAlterTableStatement.java
index 2f66eee136..eb159a7b8c 100644
--- a/src/main/java/com/alibaba/druid/sql/ast/statement/SQLAlterTableStatement.java
+++ b/src/main/java/com/alibaba/druid/sql/ast/statement/SQLAlterTableStatement.java
@@ -20,7 +20,6 @@ import java.util.List;
 
 import com.alibaba.druid.sql.ast.SQLName;
 import com.alibaba.druid.sql.ast.SQLStatementImpl;
-import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTVisitor;
 
 public class SQLAlterTableStatement extends SQLStatementImpl implements SQLDDLStatement {
diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java
index ac9e41ff9f..012f2b4c79 100644
--- a/src/main/java/com/alibaba/druid/wall/WallConfig.java
+++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java
@@ -41,9 +41,11 @@ public class WallConfig implements WallConfigMBean {
 
     private boolean             deleteAllow                = true;
     private boolean             deleteWhereAlwayTrueCheck  = true;
+    private boolean             deleteWhereNoneCheck       = false;
 
     private boolean             updateAllow                = true;
     private boolean             updateWhereAlayTrueCheck   = true;
+    private boolean             updateWhereNoneCheck       = false;
 
     private boolean             insertAllow                = true;
     private boolean             mergeAllow                 = true;
@@ -351,6 +353,14 @@ public class WallConfig implements WallConfigMBean {
     public void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck) {
         this.deleteWhereAlwayTrueCheck = deleteWhereAlwayTrueCheck;
     }
+    
+    public boolean isDeleteWhereNoneCheck() {
+        return deleteWhereNoneCheck;
+    }
+
+    public void setDeleteWhereNoneCheck(boolean deleteWhereNoneCheck) {
+        this.deleteWhereNoneCheck = deleteWhereNoneCheck;
+    }
 
     public boolean isUpdateAllow() {
         return updateAllow;
@@ -368,6 +378,14 @@ public class WallConfig implements WallConfigMBean {
         this.updateWhereAlayTrueCheck = updateWhereAlayTrueCheck;
     }
 
+    public boolean isUpdateWhereNoneCheck() {
+        return updateWhereNoneCheck;
+    }
+
+    public void setUpdateWhereNoneCheck(boolean updateWhereNoneCheck) {
+        this.updateWhereNoneCheck = updateWhereNoneCheck;
+    }
+
     public boolean isInsertAllow() {
         return insertAllow;
     }
diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index a0d844a684..f9d2d4fe43 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -225,14 +225,18 @@ public class WallVisitorUtils {
     public static void checkDelete(WallVisitor visitor, SQLDeleteStatement x) {
         checkReadOnly(visitor, x.getExprTableSource());
 
-        if (!visitor.getConfig().isDeleteAllow()) {
+        WallConfig config = visitor.getConfig();
+        if (!config.isDeleteAllow()) {
             addViolation(visitor, "delete not allow", x);
             return;
         }
 
-        if (x.getWhere() == null
-            || Boolean.TRUE == getConditionValue(visitor, x.getWhere(),
-                                                 visitor.getConfig().isDeleteWhereAlwayTrueCheck())) {
+        if (x.getWhere() == null && config.isDeleteWhereNoneCheck()) {
+            addViolation(visitor, "delete none condition not allow", x);
+            return;
+        }
+
+        if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), config.isDeleteWhereAlwayTrueCheck())) {
             addViolation(visitor, "delete alway true condition not allow", x);
             return;
         }
@@ -416,25 +420,26 @@ public class WallVisitorUtils {
     public static void checkUpdate(WallVisitor visitor, SQLUpdateStatement x) {
         checkReadOnly(visitor, x.getTableSource());
 
-        if (!visitor.getConfig().isUpdateAllow()) {
+        WallConfig config = visitor.getConfig();
+        if (!config.isUpdateAllow()) {
             addViolation(visitor, "update not allow", x);
             return;
         }
 
-        if (visitor.getConfig().isUpdateWhereAlayTrueCheck()) {
-            if (x.getWhere() == null) {
-                if (x instanceof MySqlUpdateStatement) {
-                    MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
-                    if (mysqlUpdate.getLimit() == null) {
-                        addViolation(visitor, "update none condition not allow", x);
-                        return;
-                    }
-                } else {
+        if (x.getWhere() == null && config.isUpdateWhereNoneCheck()) {
+            if (x instanceof MySqlUpdateStatement) {
+                MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
+                if (mysqlUpdate.getLimit() == null) {
                     addViolation(visitor, "update none condition not allow", x);
                     return;
                 }
+            } else {
+                addViolation(visitor, "update none condition not allow", x);
+                return;
             }
+        }
 
+        if (config.isUpdateWhereAlayTrueCheck()) {
             if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), true)) {
                 addViolation(visitor, "update alway true condition not allow", x);
                 return;
@@ -843,11 +848,11 @@ public class WallVisitorUtils {
                 WallSqlTableStat tableStat = context.getTableStat(tableName);
                 if (tableStat != null) {
                     SQLObject parent = x.getParent();
-                    
+
                     while (parent instanceof SQLTableSource) {
                         parent = parent.getParent();
                     }
-                    
+
                     if (parent instanceof SQLSelectQueryBlock) {
                         SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) parent;
                         if (x == queryBlock.getInto()) {