mirror of
https://github.com/alibaba/druid.git
synced 2023-03-04 19:17:16 +00:00
result filter && tenant support
This commit is contained in:
kiki
@@ -41,7 +41,7 @@ public class MySqlWallTest extends TestCase {
|
||||
Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from mysql.user"));
|
||||
Assert.assertTrue(WallUtils.isValidateMySql("select 'mysql.user'"));
|
||||
|
||||
Assert.assertFalse(WallUtils.isValidateMySql("select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'"));
|
||||
Assert.assertFalse(WallUtils.isValidateMySql("select * FROM T WHERE id = 1 AND select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'"));
|
||||
Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'"));
|
||||
|
||||
Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2"));
|
||||
|
||||
@@ -139,22 +139,22 @@ public class MySqlWallTest91 extends TestCase {
|
||||
}
|
||||
}
|
||||
|
||||
public void test_true3() throws Exception {
|
||||
public void test_false9() throws Exception {
|
||||
WallProvider provider = initWallProvider();
|
||||
{
|
||||
String sql = "select PROJECT_NAME, TABLE_NAME, EXPORT_COLUMNS, CURRENT_TIMESTAMP() start_time from (SELECT PROJECT_NAME, TABLE_NAME, EXPORT_COLUMNS, @rank := @rank + 1 AS rank FROM ( SELECT PROJECT_NAME, TABLE_NAME, ( SELECT CASE WHEN GROUP_CONCAT(COLUMN_name) LIKE 'ID,%' THEN SUBSTR( GROUP_CONCAT(COLUMN_name), 4 ) ELSE GROUP_CONCAT(COLUMN_name) END FROM Information_schema.`COLUMNS` A WHERE A.table_name = B.TABLE_NAME ORDER BY ORDINAL_POSITION ) EXPORT_COLUMNS FROM ETL_EXPORT b ORDER BY PROJECT_NAME, TABLE_NAME ) tmp, (SELECT @rank := 0) a) b WHERE rank='2';";
|
||||
Assert.assertTrue(provider.checkValid(sql));
|
||||
Assert.assertFalse(provider.checkValid(sql));
|
||||
}
|
||||
{
|
||||
String sql = "select PROJECT_NAME, TABLE_NAME, EXPORT_COLUMNS, CURRENT_TIMESTAMP() start_time, case when type=1 then ' where day_id = 20130101 ' when type=2 and substr('20130101','7,2')='01' then 'where month_id=201301 ' else 'where 3=5 ' end export_where_data from (SELECT PROJECT_NAME, TABLE_NAME, EXPORT_COLUMNS, type, @rank := @rank + 1 AS rank FROM ( SELECT PROJECT_NAME, TABLE_NAME, type, ( SELECT CASE WHEN GROUP_CONCAT(COLUMN_name) LIKE 'ID,%' THEN SUBSTR( GROUP_CONCAT(COLUMN_name), 4 ) ELSE GROUP_CONCAT(COLUMN_name) END FROM Information_schema.`COLUMNS` A WHERE A.table_name = concat(B.TABLE_NAME,'_','201301') ORDER BY ORDINAL_POSITION ) EXPORT_COLUMNS FROM ETL_EXPORT b where project_name in ('acc') ORDER BY PROJECT_NAME, TABLE_NAME ) tmp, (SELECT @rank := 0) a) b WHERE rank='3';";
|
||||
Assert.assertTrue(provider.checkValid(sql));
|
||||
Assert.assertFalse(provider.checkValid(sql));
|
||||
}
|
||||
}
|
||||
|
||||
public void test_true4() {
|
||||
WallProvider provider = initWallProvider();
|
||||
{
|
||||
String sql = "SELECT 10006,@";
|
||||
String sql = "SELECT 10006, @";
|
||||
Assert.assertTrue(provider.checkValid(sql));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -45,7 +45,6 @@ public class TenantDeleteTest extends TestCase {
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("DELETE FROM orders" + //
|
||||
"\nWHERE tenant = 123" + //
|
||||
"\n\tAND FID = ?", resultSql);
|
||||
"\nWHERE FID = ?", resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,159 @@
|
||||
/*
|
||||
* Copyright 2013 Alibaba Group Holding Ltd.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
// Created on 2013-10-17
|
||||
// $Id$
|
||||
|
||||
package com.alibaba.druid.bvt.filter.wall;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.junit.Assert;
|
||||
|
||||
import com.alibaba.druid.sql.SQLUtils;
|
||||
import com.alibaba.druid.util.JdbcConstants;
|
||||
import com.alibaba.druid.wall.WallCheckResult;
|
||||
import com.alibaba.druid.wall.WallConfig;
|
||||
import com.alibaba.druid.wall.WallProvider;
|
||||
import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
/**
|
||||
* @author kiki
|
||||
*/
|
||||
public class TenantInsertTest extends TestCase {
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql3() throws Exception {
|
||||
String insert_sql = "INSERT INTO orders (ID, NAME) VALUES (1, \"KIKI\")";
|
||||
String expect_sql = "INSERT INTO orders (ID, NAME, tenant)" + //
|
||||
"\nVALUES (1, 'KIKI', 123)";
|
||||
{
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
{
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public void testMySql4() throws Exception {
|
||||
String insert_sql = "INSERT INTO orders (ID, NAME) VALUES (1, \"KIKI\"), (1, \"CICI\")";
|
||||
String expect_sql = "INSERT INTO orders (ID, NAME, tenant)" + //
|
||||
"\nVALUES (1, 'KIKI', 123)," + //
|
||||
"\n\t(1, 'CICI', 123)";
|
||||
|
||||
{
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
{
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public void testMySql5() throws Exception {
|
||||
String insert_sql = "INSERT INTO orders (ID, NAME) SELECT ID, NAME FROM temp WHERE age = 18";
|
||||
String expect_sql = "INSERT INTO orders (ID, NAME, tenant)" + //
|
||||
"\nSELECT ID, NAME, 123" + //
|
||||
"\nFROM temp" + //
|
||||
"\nWHERE age = 18";
|
||||
|
||||
{
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
{
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
public void testMySql6() throws Exception {
|
||||
String insert_sql = "INSERT INTO orders (ID, NAME) SELECT ID, NAME FROM temp1 WHERE age = 18 UNION SELECT ID, NAME FROM temp2 UNION ALL SELECT ID, NAME FROM temp3";
|
||||
String expect_sql = "INSERT INTO orders (ID, NAME, tenant)" + //
|
||||
"\nSELECT ID, NAME, 123" + //
|
||||
"\nFROM temp1" + //
|
||||
"\nWHERE age = 18" + //
|
||||
"\nUNION" + //
|
||||
"\nSELECT ID, NAME, 123" + //
|
||||
"\nFROM temp2" + //
|
||||
"\nUNION ALL" + //
|
||||
"\nSELECT ID, NAME, 123" + //
|
||||
"\nFROM temp3";
|
||||
|
||||
{
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
{
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(insert_sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -28,13 +28,19 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
public class TenantSelectTest extends TestCase {
|
||||
|
||||
private String sql = "SELECT ID, NAME FROM orders WHERE FID = ?";
|
||||
private String sql = "SELECT ID, NAME FROM orders WHERE FID = ?";
|
||||
private String expect_sql = "SELECT ID, NAME, tenant" + //
|
||||
"\nFROM orders" + //
|
||||
"\nWHERE FID = ?";
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
@@ -44,9 +50,15 @@ public class TenantSelectTest extends TestCase {
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("SELECT ID, NAME" + //
|
||||
"\nFROM orders" + //
|
||||
"\nWHERE tenant = 123" + //
|
||||
"\n\tAND FID = ?", resultSql);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
public void testMySql2() throws Exception {
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,13 +28,20 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
public class TenantSelectTest2 extends TestCase {
|
||||
|
||||
private String sql = "SELECT ID, NAME FROM orders WHERE FID = ? OR FID = ?";
|
||||
private String sql = "SELECT ID, NAME FROM orders WHERE FID = ? OR FID = ?";
|
||||
private String expect_sql = "SELECT ID, NAME, tenant" + //
|
||||
"\nFROM orders" + //
|
||||
"\nWHERE FID = ?" + //
|
||||
"\n\tOR FID = ?";
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
@@ -44,10 +51,15 @@ public class TenantSelectTest2 extends TestCase {
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("SELECT ID, NAME" + //
|
||||
"\nFROM orders" + //
|
||||
"\nWHERE tenant = 123" + //
|
||||
"\n\tAND (FID = ?" +
|
||||
"\n\t\tOR FID = ?)", resultSql);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
public void testMySql2() throws Exception {
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,15 +28,23 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
public class TenantSelectTest3 extends TestCase {
|
||||
|
||||
private String sql = "SELECT ID, NAME " + //
|
||||
"FROM orders o inner join users u ON o.userid = u.id " + //
|
||||
"WHERE FID = ? OR FID = ?";
|
||||
private String sql = "SELECT ID, NAME " + //
|
||||
"FROM orders o inner join users u ON o.userid = u.id " + //
|
||||
"WHERE FID = ? OR FID = ?";
|
||||
private String expect_sql = "SELECT ID, NAME, u.tenant, o.tenant" + //
|
||||
"\nFROM orders o" + //
|
||||
"\n\tINNER JOIN users u ON o.userid = u.id" + //
|
||||
"\nWHERE FID = ?" + //
|
||||
"\n\tOR FID = ?";
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
@@ -46,12 +54,15 @@ public class TenantSelectTest3 extends TestCase {
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("SELECT ID, NAME" + //
|
||||
"\nFROM orders o" + //
|
||||
"\n\tINNER JOIN users u ON u.tenant = 123" + //
|
||||
"\n\t\tAND o.userid = u.id" + //
|
||||
"\nWHERE o.tenant = 123" + //
|
||||
"\n\tAND (FID = ?" + //
|
||||
"\n\t\tOR FID = ?)", resultSql);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
public void testMySql2() throws Exception {
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,15 +28,23 @@ import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
public class TenantSelectTest4 extends TestCase {
|
||||
|
||||
private String sql = "SELECT a.*,b.name " + //
|
||||
"FROM vote_info a left join vote_item b on a.item_id=b.id " + //
|
||||
"where 1=1 limit 1,10";
|
||||
private String sql = "SELECT a.*,b.name " + //
|
||||
"FROM vote_info a left join vote_item b on a.item_id=b.id " + //
|
||||
"where 1=1 limit 1,10";
|
||||
private String expect_sql = "SELECT a.*, b.name, b.tenant, a.tenant" + //
|
||||
"\nFROM vote_info a" + //
|
||||
"\n\tLEFT JOIN vote_item b ON a.item_id = b.id" + //
|
||||
"\nWHERE 1 = 1" + //
|
||||
"\nLIMIT 1, 10";
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
@@ -46,12 +54,15 @@ public class TenantSelectTest4 extends TestCase {
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("SELECT a.*, b.name" + //
|
||||
"\nFROM vote_info a" + //
|
||||
"\n\tLEFT JOIN vote_item b ON b.tenant = 123" + //
|
||||
"\n\t\tAND a.item_id = b.id" + //
|
||||
"\nWHERE a.tenant = 123" + //
|
||||
"\n\tAND 1 = 1" + //
|
||||
"\nLIMIT 1, 10", resultSql);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
public void testMySql2() throws Exception {
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
/*
|
||||
* Copyright 1999-2011 Alibaba Group Holding Ltd.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package com.alibaba.druid.bvt.filter.wall;
|
||||
|
||||
import com.alibaba.druid.wall.WallConfig.TenantCallBack;
|
||||
|
||||
public class TenantTestCallBack implements TenantCallBack {
|
||||
|
||||
@Override
|
||||
public Object getTenantValue(StatementType statementType, String tableName) {
|
||||
return 123;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getTenantColumn(StatementType statementType, String tableName) {
|
||||
return "tenant";
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHiddenColumn(String tableName) {
|
||||
return "tenant";
|
||||
}
|
||||
|
||||
@Override
|
||||
public void resultset_hiddenColumn(Object value) {
|
||||
System.out.println(value);
|
||||
}
|
||||
}
|
||||
@@ -27,27 +27,39 @@ import com.alibaba.druid.wall.WallProvider;
|
||||
import com.alibaba.druid.wall.spi.MySqlWallProvider;
|
||||
|
||||
public class TenantUpdateTest extends TestCase {
|
||||
private String sql = "UPDATE T_USER SET FNAME = ? WHERE FID = ?";
|
||||
|
||||
private WallConfig config = new WallConfig();
|
||||
private String sql = "UPDATE T_USER SET FNAME = ? WHERE FID = ?";
|
||||
private String expect_sql = "UPDATE T_USER" + //
|
||||
"\nSET FNAME = ?, tenant = 123" + //
|
||||
"\nWHERE FID = ?";
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
config.setDeleteAllow(false);
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
}
|
||||
private WallConfig config = new WallConfig();
|
||||
private WallConfig config_callback = new WallConfig();
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
protected void setUp() throws Exception {
|
||||
config.setTenantTablePattern("*");
|
||||
config.setTenantColumn("tenant");
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(),
|
||||
JdbcConstants.MYSQL);
|
||||
Assert.assertEquals("UPDATE T_USER" + //
|
||||
"\nSET FNAME = ?" + //
|
||||
"\nWHERE tenant = 123" + //
|
||||
"\n\tAND FID = ?", resultSql);
|
||||
}
|
||||
config_callback.setTenantCallBack(new TenantTestCallBack());
|
||||
}
|
||||
|
||||
public void testMySql() throws Exception {
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
|
||||
public void testMySql2() throws Exception {
|
||||
WallProvider.setTenantValue(123);
|
||||
MySqlWallProvider provider = new MySqlWallProvider(config_callback);
|
||||
WallCheckResult checkResult = provider.check(sql);
|
||||
Assert.assertEquals(0, checkResult.getViolations().size());
|
||||
|
||||
String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
|
||||
Assert.assertEquals(expect_sql, resultSql);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,400 @@
|
||||
package com.alibaba.druid.bvt.filter.wall;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.Statement;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.junit.Assert;
|
||||
|
||||
import com.alibaba.druid.filter.Filter;
|
||||
import com.alibaba.druid.pool.DruidDataSource;
|
||||
import com.alibaba.druid.util.JdbcConstants;
|
||||
import com.alibaba.druid.wall.WallConfig;
|
||||
import com.alibaba.druid.wall.WallFilter;
|
||||
|
||||
public class WallFilterTest3 extends TestCase {
|
||||
|
||||
private DruidDataSource dataSource;
|
||||
private WallFilter wallFilter;
|
||||
|
||||
protected void setUp() throws Exception {
|
||||
dataSource = new DruidDataSource();
|
||||
|
||||
dataSource.setUrl("jdbc:h2:mem:wall_test;");
|
||||
// dataSource.setFilters("wall");
|
||||
dataSource.setDbType(JdbcConstants.MARIADB);
|
||||
|
||||
WallConfig config = new WallConfig();
|
||||
config.setTenantCallBack(new TenantTestCallBack());
|
||||
|
||||
wallFilter = new WallFilter();
|
||||
wallFilter.setConfig(config);
|
||||
wallFilter.setDbType(JdbcConstants.MARIADB);
|
||||
List<Filter> filters = new LinkedList<Filter>();
|
||||
filters.add(wallFilter);
|
||||
dataSource.setProxyFilters(filters);
|
||||
|
||||
dataSource.init();
|
||||
|
||||
}
|
||||
|
||||
protected void tearDown() throws Exception {
|
||||
dataSource.close();
|
||||
}
|
||||
|
||||
public void test_wallFilter() throws Exception {
|
||||
Assert.assertEquals(JdbcConstants.MARIADB, wallFilter.getDbType());
|
||||
Assert.assertFalse(wallFilter.isLogViolation());
|
||||
wallFilter.setLogViolation(true);
|
||||
Assert.assertTrue(wallFilter.isLogViolation());
|
||||
wallFilter.setLogViolation(false);
|
||||
Assert.assertFalse(wallFilter.isLogViolation());
|
||||
|
||||
Assert.assertTrue(wallFilter.isThrowException());
|
||||
wallFilter.setThrowException(false);
|
||||
Assert.assertFalse(wallFilter.isThrowException());
|
||||
wallFilter.setThrowException(true);
|
||||
Assert.assertTrue(wallFilter.isThrowException());
|
||||
|
||||
wallFilter.clearProviderCache();
|
||||
wallFilter.getProviderWhiteList();
|
||||
Assert.assertTrue(wallFilter.isInited());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.execute("CREATE TABLE t (FID INTEGER, FNAME VARCHAR(50), TENANT VARCHAR(32))");
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(1, wallFilter.getProvider().getTableStat("t").getCreateCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
String sql = "INSERT INTO t (FID, FNAME) VALUES (?, ?)";
|
||||
|
||||
for (int i = 0; i < 10; ++i) {
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, Statement.NO_GENERATED_KEYS);
|
||||
stmt.setInt(1, i + 10);
|
||||
stmt.setString(2, "a" + (i + 10));
|
||||
stmt.execute();
|
||||
stmt.close();
|
||||
}
|
||||
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(10, wallFilter.getProvider().getTableStat("t").getInsertCount());
|
||||
Assert.assertEquals(10, wallFilter.getProvider().getTableStat("t").getInsertDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
String sql = "INSERT INTO t (FID, FNAME) VALUES (?, ?)";
|
||||
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, Statement.NO_GENERATED_KEYS);
|
||||
for (int i = 0; i < 10; ++i) {
|
||||
stmt.setInt(1, i + 20);
|
||||
stmt.setString(2, "a" + (i + 20));
|
||||
stmt.addBatch();
|
||||
}
|
||||
stmt.executeBatch();
|
||||
stmt.close();
|
||||
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(11, wallFilter.getProvider().getTableStat("t").getInsertCount());
|
||||
Assert.assertEquals(20, wallFilter.getProvider().getTableStat("t").getInsertDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
for (int i = 0; i < 10; ++i) {
|
||||
stmt.addBatch("INSERT INTO t (FID, FNAME) VALUES (" + i + ", 'a" + i + "')");
|
||||
}
|
||||
stmt.executeBatch();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(21, wallFilter.getProvider().getTableStat("t").getInsertCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
{
|
||||
String sql = "SELECT * FROM T";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(30, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, ResultSet.TYPE_FORWARD_ONLY,
|
||||
ResultSet.CONCUR_READ_ONLY,
|
||||
ResultSet.HOLD_CURSORS_OVER_COMMIT);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(60, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, new int[0]);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(70, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement(sql, new String[0]);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(80, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareCall(sql);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(90, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareCall(sql, ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(100, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareCall(sql, ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY,
|
||||
ResultSet.HOLD_CURSORS_OVER_COMMIT);
|
||||
ResultSet rs = stmt.executeQuery();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(130, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
|
||||
stmt.execute(sql, Statement.NO_GENERATED_KEYS);
|
||||
ResultSet rs = stmt.getResultSet();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(140, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY,
|
||||
ResultSet.HOLD_CURSORS_OVER_COMMIT);
|
||||
stmt.execute(sql, new int[0]);
|
||||
ResultSet rs = stmt.getResultSet();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(150, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
String sql = "SELECT * FROM T LIMIT 10";
|
||||
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY,
|
||||
ResultSet.HOLD_CURSORS_OVER_COMMIT);
|
||||
stmt.execute(sql, new String[0]);
|
||||
ResultSet rs = stmt.getResultSet();
|
||||
while (rs.next()) {
|
||||
|
||||
}
|
||||
rs.close();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(160, wallFilter.getProvider().getTableStat("t").getFetchRowCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeUpdate("DELETE from t where FID = 0");
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(1, wallFilter.getProvider().getTableStat("t").getDeleteDataCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeUpdate("DELETE from t where FID = 1 OR FID = 2", Statement.NO_GENERATED_KEYS);
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(3, wallFilter.getProvider().getTableStat("t").getDeleteDataCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeUpdate("DELETE from t where FID = 3", new int[0]);
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(4, wallFilter.getProvider().getTableStat("t").getDeleteDataCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeUpdate("DELETE from t where FID = 4", new String[0]);
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(5, wallFilter.getProvider().getTableStat("t").getDeleteDataCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement("DELETE from t where FID = ?");
|
||||
stmt.setInt(1, 5);
|
||||
stmt.executeUpdate();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(6, wallFilter.getProvider().getTableStat("t").getDeleteDataCount());
|
||||
Assert.assertEquals(0, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.execute("update t SET fname = 'xx' where FID = 13 OR FID = 14");
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(2, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement("update t SET fname = 'xx' where FID = ? OR FID = ?");
|
||||
stmt.setInt(1, 13);
|
||||
stmt.setInt(2, 14);
|
||||
stmt.execute();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(4, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement("update t SET fname = 'xx' where FID = ? OR FID = ?");
|
||||
stmt.setInt(1, 13);
|
||||
stmt.setInt(2, 14);
|
||||
stmt.execute();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(6, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
PreparedStatement stmt = conn.prepareStatement("update t SET fname = 'xx' where FID = ?");
|
||||
|
||||
stmt.setInt(1, 13);
|
||||
stmt.addBatch();
|
||||
|
||||
stmt.setInt(1, 14);
|
||||
stmt.addBatch();
|
||||
|
||||
stmt.executeBatch();
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(8, wallFilter.getProvider().getTableStat("t").getUpdateDataCount());
|
||||
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.execute("truncate table t");
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(1, wallFilter.getProvider().getTableStat("t").getTruncateCount());
|
||||
{
|
||||
Connection conn = dataSource.getConnection();
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.execute("drop table t");
|
||||
stmt.close();
|
||||
conn.close();
|
||||
}
|
||||
Assert.assertEquals(1, wallFilter.getProvider().getTableStat("t").getDropCount());
|
||||
|
||||
Assert.assertEquals(0, wallFilter.getViolationCount());
|
||||
wallFilter.resetViolationCount();
|
||||
wallFilter.checkValid("select 1");
|
||||
Assert.assertEquals(0, wallFilter.getViolationCount());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user