Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve wall filter

Browse Source
This commit is contained in:
wenshao
2013-04-09 19:08:14 +08:00
parent c814766889
commit 2a7af9be6a
11 changed files with 167 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java
+2 -2
View File
@@ -25,14 +25,14 @@ import com.alibaba.druid.wall.WallUtils;
public class MySqlWallPermitTableTest extends TestCase {
public void test_default() throws Exception {
Assert.assertFalse(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )"));
Assert.assertFalse(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) ) FROM X"));
}
public void test_allow() throws Exception {
WallConfig config = new WallConfig();
config.setTableCheck(false);
Assert.assertTrue(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )", config));
Assert.assertTrue(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) ) FROM X", config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
+1 -1
View File
@@ -30,7 +30,7 @@ public class MySqlWallTest extends TestCase {
Assert.assertFalse(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'"));
Assert.assertFalse(WallUtils.isValidateMySql("select 15,version()"));
Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X"));
Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'"));
Assert.assertFalse(WallUtils.isValidateMySql("select 1 from information_schema.columns"));
src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java
+2 -2
View File
@@ -30,13 +30,13 @@ import com.alibaba.druid.wall.WallUtils;
public class OracleWallPermitFunctionTest extends TestCase {
public void test_permitTable() throws Exception {
Assert.assertFalse(WallUtils.isValidateOracle("select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from dual"));
Assert.assertFalse(WallUtils.isValidateOracle("select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X"));
}
public void test_permitTable_allow() throws Exception {
WallConfig config = new WallConfig();
config.setFunctionCheck(false);
Assert.assertTrue(WallUtils.isValidateOracle("select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from dual", config));
Assert.assertTrue(WallUtils.isValidateOracle("select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X", config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java
+14 -14
View File
@@ -52,7 +52,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
}
public void test01() throws Exception {
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name();"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;"));
}
public final void test_sp_addsrvrolemenber() throws Exception {
@@ -72,12 +72,12 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
}
public final void test_db_name() throws Exception {
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); "));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME() FROM X"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0) FROM X; "));
}
public final void test_host_name() throws Exception {
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME() FROM X"));
}
/**
@@ -85,16 +85,16 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
* @throws Exception
*/
public void test_is_srvrolemember() throws Exception {
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin’);"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’); "));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); "));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin’) FROM X;"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X; "));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; "));
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_statMap.java
+2 -2
View File
@@ -55,11 +55,11 @@ public class WallStatTest_statMap extends TestCase {
System.out.println(JSONUtils.toJSONString(statMapMerged));
Assert.assertEquals(2L, statMapMerged.get("checkCount"));
Assert.assertEquals(2, ((Collection<String>) statMapMerged.get("blackList")).size());
Assert.assertEquals(2, ((Collection<Map<String, Object>>) statMapMerged.get("blackList")).size());
statMapMerged = DruidStatManagerFacade.mergWallStat(statMapMerged, statMapC);
System.out.println(JSONUtils.toJSONString(statMapMerged));
Assert.assertEquals(2, ((Collection<String>) statMapMerged.get("blackList")).size());
Assert.assertEquals(2, ((Collection<Map<String, Object>>) statMapMerged.get("blackList")).size());
}
}