From 2308716354b7b115b931fac635ea6bd9a9a818ef Mon Sep 17 00:00:00 2001 From: wenshao Date: Sun, 17 Mar 2013 09:33:50 +0800 Subject: [PATCH] refactor WallFilter, change permit > deny --- .../com/alibaba/druid/wall/WallConfig.java | 113 ++++++++++-------- .../druid/wall/spi/WallVisitorUtils.java | 9 +- ...{permit-function.txt => deny-function.txt} | 0 .../{permit-object.txt => deny-object.txt} | 0 .../{permit-schema.txt => deny-schema.txt} | 0 .../{permit-table.txt => deny-table.txt} | 0 .../{permit-variant.txt => deny-variant.txt} | 0 .../bvt/filter/wall/WallReadOnlyTest.java | 2 +- 8 files changed, 71 insertions(+), 53 deletions(-) rename src/main/resources/META-INF/druid/wall/sqlserver/{permit-function.txt => deny-function.txt} (100%) rename src/main/resources/META-INF/druid/wall/sqlserver/{permit-object.txt => deny-object.txt} (100%) rename src/main/resources/META-INF/druid/wall/sqlserver/{permit-schema.txt => deny-schema.txt} (100%) rename src/main/resources/META-INF/druid/wall/sqlserver/{permit-table.txt => deny-table.txt} (100%) rename src/main/resources/META-INF/druid/wall/sqlserver/{permit-variant.txt => deny-variant.txt} (100%) diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 70e59fdbf2..dd474e28fe 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -17,69 +17,70 @@ package com.alibaba.druid.wall; import static com.alibaba.druid.wall.spi.WallVisitorUtils.loadResource; -import java.util.HashSet; import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.ConcurrentMap; import com.alibaba.druid.wall.spi.WallVisitorUtils; public class WallConfig implements WallConfigMBean { - private boolean noneBaseStatementAllow = false; + private boolean noneBaseStatementAllow = false; - private boolean callAllow = true; - private boolean selelctAllow = true; - private boolean selectIntoAllow = true; - private boolean selectIntoOutfileAllow = false; - private boolean selectWhereAlwayTrueCheck = true; - private boolean selectHavingAlwayTrueCheck = true; - private boolean selectUnionCheck = true; + private boolean callAllow = true; + private boolean selelctAllow = true; + private boolean selectIntoAllow = true; + private boolean selectIntoOutfileAllow = false; + private boolean selectWhereAlwayTrueCheck = true; + private boolean selectHavingAlwayTrueCheck = true; + private boolean selectUnionCheck = true; - private boolean selectAllColumnAllow = true; + private boolean selectAllColumnAllow = true; - private boolean deleteAllow = true; - private boolean deleteWhereAlwayTrueCheck = true; + private boolean deleteAllow = true; + private boolean deleteWhereAlwayTrueCheck = true; - private boolean updateAllow = true; - private boolean updateWhereAlayTrueCheck = true; + private boolean updateAllow = true; + private boolean updateWhereAlayTrueCheck = true; - private boolean insertAllow = true; - private boolean mergeAllow = true; + private boolean insertAllow = true; + private boolean mergeAllow = true; - private boolean multiStatementAllow = false; + private boolean multiStatementAllow = false; - private boolean truncateAllow = false; + private boolean truncateAllow = false; - private boolean commentAllow = false; + private boolean commentAllow = false; - private boolean describeAllow = false; + private boolean describeAllow = false; - private boolean schemaCheck = true; - private boolean tableCheck = true; - private boolean functionCheck = true; - private boolean objectCheck = true; - private boolean variantCheck = true; + private boolean schemaCheck = true; + private boolean tableCheck = true; + private boolean functionCheck = true; + private boolean objectCheck = true; + private boolean variantCheck = true; - private boolean mustParameterized = false; + private boolean mustParameterized = false; - private boolean doPrivilegedAllow = false; + private boolean doPrivilegedAllow = false; - protected final Set denyFunctions = new HashSet(); - protected final Set denyTables = new HashSet(); - protected final Set denySchemas = new HashSet(); - protected final Set denyVariants = new HashSet(); - protected final Set denyObjects = new HashSet(); + protected final ConcurrentMap denyFunctions = new ConcurrentHashMap(); + protected final ConcurrentMap denyTables = new ConcurrentHashMap(); + protected final ConcurrentMap denySchemas = new ConcurrentHashMap(); + protected final ConcurrentMap denyVariants = new ConcurrentHashMap(); + protected final ConcurrentMap denyObjects = new ConcurrentHashMap(); - protected final Set readOnlyTables = new HashSet(); + protected final ConcurrentMap readOnlyTables = new ConcurrentHashMap(); - private String dir; + private String dir; - private boolean inited; + private boolean inited; - private String tenantTablePattern; - private String tenantColumn; + private String tenantTablePattern; + private String tenantColumn; - private boolean wrapAllow = true; - private boolean metadataAllow = true; + private boolean wrapAllow = true; + private boolean metadataAllow = true; public WallConfig(){ @@ -358,27 +359,43 @@ public class WallConfig implements WallConfigMBean { } public Set getDenyFunctions() { - return denyFunctions; + return denyFunctions.keySet(); } public Set getDenyTables() { - return denyTables; + return denyTables.keySet(); } public Set getDenySchemas() { - return denySchemas; + return denySchemas.keySet(); } public Set getDenyVariants() { - return denyVariants; + return denyVariants.keySet(); } public Set getDenyObjects() { - return denyObjects; + return denyObjects.keySet(); } public Set getReadOnlyTables() { - return readOnlyTables; + return readOnlyTables.keySet(); + } + + public void addReadOnlyTable(String tableName) { + this.readOnlyTables.putIfAbsent(tableName, new WallDenyStat()); + } + + public boolean checkReadOnly(String tableName) { + WallDenyStat wallStat = this.readOnlyTables.get(tableName); + + if (wallStat == null) { + return false; + } + + wallStat.incrementAndGetDenyCount(); + + return true; } public boolean isMustParameterized() { @@ -395,7 +412,7 @@ public class WallConfig implements WallConfigMBean { } name = WallVisitorUtils.form(name); - return denyObjects.contains(name); + return denyObjects.containsKey(name); } public boolean isDenySchema(String name) { @@ -404,7 +421,7 @@ public class WallConfig implements WallConfigMBean { } name = WallVisitorUtils.form(name); - return this.denySchemas.contains(name); + return this.denySchemas.containsKey(name); } public boolean isDenyFunction(String name) { @@ -413,7 +430,7 @@ public class WallConfig implements WallConfigMBean { } name = WallVisitorUtils.form(name); - return this.denyFunctions.contains(name); + return this.denyFunctions.containsKey(name); } public boolean isCallAllow() { diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 4a5ab161c9..35c733fff1 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -24,7 +24,7 @@ import java.net.URL; import java.util.ArrayList; import java.util.Enumeration; import java.util.List; -import java.util.Set; +import java.util.concurrent.ConcurrentMap; import com.alibaba.druid.sql.ast.SQLExpr; import com.alibaba.druid.sql.ast.SQLName; @@ -63,6 +63,7 @@ import com.alibaba.druid.support.logging.Log; import com.alibaba.druid.support.logging.LogFactory; import com.alibaba.druid.util.JdbcUtils; import com.alibaba.druid.util.ServletPathMatcher; +import com.alibaba.druid.wall.WallDenyStat; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallVisitor; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; @@ -350,7 +351,7 @@ public class WallVisitorUtils { if (tableName != null) { tableName = form(tableName); - if (visitor.getConfig().getReadOnlyTables().contains(tableName)) { + if (visitor.getConfig().checkReadOnly(tableName)) { addViolation(visitor, tableSource); } } @@ -850,7 +851,7 @@ public class WallVisitorUtils { return name; } - public static void loadResource(Set names, String resource) { + public static void loadResource(ConcurrentMap names, String resource) { try { Enumeration e = Thread.currentThread().getContextClassLoader().getResources(resource); while (e.hasMoreElements()) { @@ -868,7 +869,7 @@ public class WallVisitorUtils { line = line.trim(); if (line.length() > 0) { line = line.toLowerCase(); - names.add(line); + names.put(line, new WallDenyStat()); } } diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt rename to src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-object.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt rename to src/main/resources/META-INF/druid/wall/sqlserver/deny-object.txt diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-schema.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/sqlserver/permit-schema.txt rename to src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-table.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/sqlserver/permit-table.txt rename to src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt rename to src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallReadOnlyTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallReadOnlyTest.java index a883648ce0..e6224353f8 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallReadOnlyTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallReadOnlyTest.java @@ -31,7 +31,7 @@ public class WallReadOnlyTest extends TestCase { private WallConfig config = new WallConfig(); protected void setUp() throws Exception { - config.getReadOnlyTables().add("members"); + config.addReadOnlyTable("members"); } private String sql = "SELECT F1, F2 members"; private String insert_sql = "INSERT INTO members (FID, FNAME) VALUES (?, ?)";