mirror of
https://github.com/alibaba/druid.git
synced 2023-03-04 19:17:16 +00:00
Yako
@@ -27,11 +27,11 @@ public class WallConfig implements WallConfigMBean {
|
||||
private boolean noneBaseStatementAllow = false;
|
||||
|
||||
private boolean callAllow = true;
|
||||
private boolean selectAllow = true;
|
||||
private boolean selelctAllow = true;
|
||||
private boolean selectIntoAllow = true;
|
||||
private boolean selectIntoOutfileAllow = false;
|
||||
private boolean selectWhereAlwaysTrueCheck = true;
|
||||
private boolean selectHavingAlwaysTrueCheck = true;
|
||||
private boolean selectWhereAlwayTrueCheck = true;
|
||||
private boolean selectHavingAlwayTrueCheck = true;
|
||||
private boolean selectUnionCheck = true;
|
||||
private boolean selectMinusCheck = true;
|
||||
private boolean selectExceptCheck = true;
|
||||
@@ -42,19 +42,19 @@ public class WallConfig implements WallConfigMBean {
|
||||
private boolean renameTableAllow = true;
|
||||
private boolean hintAllow = true;
|
||||
|
||||
private boolean conditionAndAlwaysTrueAllow = false;
|
||||
private boolean conditionAndAlwaysFalseAllow = false;
|
||||
private boolean conditionAndAlwayTrueAllow = false;
|
||||
private boolean conditionAndAlwayFalseAllow = false;
|
||||
private boolean conditionDoubleConstAllow = false;
|
||||
private boolean conditionLikeTrueAllow = true;
|
||||
|
||||
private boolean selectAllColumnAllow = true;
|
||||
|
||||
private boolean deleteAllow = true;
|
||||
private boolean deleteWhereAlwaysTrueCheck = true;
|
||||
private boolean deleteWhereAlwayTrueCheck = true;
|
||||
private boolean deleteWhereNoneCheck = false;
|
||||
|
||||
private boolean updateAllow = true;
|
||||
private boolean updateWhereAlwaysTrueCheck = true;
|
||||
private boolean updateWhereAlayTrueCheck = true;
|
||||
private boolean updateWhereNoneCheck = false;
|
||||
|
||||
private boolean insertAllow = true;
|
||||
@@ -114,7 +114,7 @@ public class WallConfig implements WallConfigMBean {
|
||||
private boolean metadataAllow = true;
|
||||
|
||||
private boolean conditionOpXorAllow = false;
|
||||
private boolean conditionOpBitwiseAllow = true;
|
||||
private boolean conditionOpBitwseAllow = true;
|
||||
|
||||
private boolean caseConditionConstAllow = false;
|
||||
|
||||
@@ -154,22 +154,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.limitZeroAllow = limitZero;
|
||||
}
|
||||
|
||||
public boolean isConditionAndAlwaysTrueAllow() {
|
||||
return conditionAndAlwaysTrueAllow;
|
||||
}
|
||||
|
||||
public void setConditionAndAlwaysTrueAllow(boolean conditionAndAlwaysTrueAllow) {
|
||||
this.conditionAndAlwaysTrueAllow = conditionAndAlwaysTrueAllow;
|
||||
}
|
||||
|
||||
public boolean isConditionAndAlwaysFalseAllow() {
|
||||
return conditionAndAlwaysFalseAllow;
|
||||
}
|
||||
|
||||
public void setConditionAndAlwaysFalseAllow(boolean conditionAndAlwaysFalseAllow) {
|
||||
this.conditionAndAlwaysFalseAllow = conditionAndAlwaysFalseAllow;
|
||||
}
|
||||
|
||||
public boolean isUseAllow() {
|
||||
return useAllow;
|
||||
}
|
||||
@@ -218,14 +202,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.conditionOpXorAllow = conditionOpXorAllow;
|
||||
}
|
||||
|
||||
public boolean isConditionOpBitwiseAllow() {
|
||||
return conditionOpBitwiseAllow;
|
||||
}
|
||||
|
||||
public void setConditionOpBitwiseAllow(boolean conditionOpBitwiseAllow) {
|
||||
this.conditionOpBitwiseAllow = conditionOpBitwiseAllow;
|
||||
}
|
||||
|
||||
public String getTenantTablePattern() {
|
||||
return tenantTablePattern;
|
||||
}
|
||||
@@ -365,14 +341,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.truncateAllow = truncateAllow;
|
||||
}
|
||||
|
||||
public boolean isSelectAllow() {
|
||||
return selectAllow;
|
||||
}
|
||||
|
||||
public void setSelectAllow(boolean selelctAllow) {
|
||||
this.selectAllow = selelctAllow;
|
||||
}
|
||||
|
||||
public boolean isSelectIntoAllow() {
|
||||
return selectIntoAllow;
|
||||
}
|
||||
@@ -453,22 +421,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.selectIntersectCheck = selectIntersectCheck;
|
||||
}
|
||||
|
||||
public boolean isSelectWhereAlwaysTrueCheck() {
|
||||
return selectWhereAlwaysTrueCheck;
|
||||
}
|
||||
|
||||
public void setSelectWhereAlwaysTrueCheck(boolean selectWhereAlwayTrueCheck) {
|
||||
this.selectWhereAlwaysTrueCheck = selectWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isSelectHavingAlwaysTrueCheck() {
|
||||
return selectHavingAlwaysTrueCheck;
|
||||
}
|
||||
|
||||
public void setSelectHavingAlwaysTrueCheck(boolean selectHavingAlwayTrueCheck) {
|
||||
this.selectHavingAlwaysTrueCheck = selectHavingAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isDeleteAllow() {
|
||||
return deleteAllow;
|
||||
}
|
||||
@@ -477,14 +429,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.deleteAllow = deleteAllow;
|
||||
}
|
||||
|
||||
public boolean isDeleteWhereAlwaysTrueCheck() {
|
||||
return deleteWhereAlwaysTrueCheck;
|
||||
}
|
||||
|
||||
public void setDeleteWhereAlwaysTrueCheck(boolean deleteWhereAlwayTrueCheck) {
|
||||
this.deleteWhereAlwaysTrueCheck = deleteWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isDeleteWhereNoneCheck() {
|
||||
return deleteWhereNoneCheck;
|
||||
}
|
||||
@@ -501,14 +445,6 @@ public class WallConfig implements WallConfigMBean {
|
||||
this.updateAllow = updateAllow;
|
||||
}
|
||||
|
||||
public boolean isUpdateWhereAlwaysTrueCheck() {
|
||||
return updateWhereAlwaysTrueCheck;
|
||||
}
|
||||
|
||||
public void setUpdateWhereAlwaysTrueCheck(boolean updateWhereAlayTrueCheck) {
|
||||
this.updateWhereAlwaysTrueCheck = updateWhereAlayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isUpdateWhereNoneCheck() {
|
||||
return updateWhereNoneCheck;
|
||||
}
|
||||
@@ -713,7 +649,7 @@ public class WallConfig implements WallConfigMBean {
|
||||
public void setCallAllow(boolean callAllow) {
|
||||
this.callAllow = callAllow;
|
||||
}
|
||||
|
||||
|
||||
public boolean isHintAllow() {
|
||||
return hintAllow;
|
||||
}
|
||||
@@ -748,4 +684,72 @@ public class WallConfig implements WallConfigMBean {
|
||||
void filterResultsetTenantColumn(Object value);
|
||||
}
|
||||
|
||||
public boolean isSelelctAllow() {
|
||||
return selelctAllow;
|
||||
}
|
||||
|
||||
public void setSelelctAllow(boolean selelctAllow) {
|
||||
this.selelctAllow = selelctAllow;
|
||||
}
|
||||
|
||||
public boolean isSelectWhereAlwayTrueCheck() {
|
||||
return selectWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public void setSelectWhereAlwayTrueCheck(boolean selectWhereAlwayTrueCheck) {
|
||||
this.selectWhereAlwayTrueCheck = selectWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isSelectHavingAlwayTrueCheck() {
|
||||
return selectHavingAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public void setSelectHavingAlwayTrueCheck(boolean selectHavingAlwayTrueCheck) {
|
||||
this.selectHavingAlwayTrueCheck = selectHavingAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isConditionAndAlwayTrueAllow() {
|
||||
return conditionAndAlwayTrueAllow;
|
||||
}
|
||||
|
||||
public void setConditionAndAlwayTrueAllow(boolean conditionAndAlwayTrueAllow) {
|
||||
this.conditionAndAlwayTrueAllow = conditionAndAlwayTrueAllow;
|
||||
}
|
||||
|
||||
public boolean isConditionAndAlwayFalseAllow() {
|
||||
return conditionAndAlwayFalseAllow;
|
||||
}
|
||||
|
||||
public void setConditionAndAlwayFalseAllow(boolean conditionAndAlwayFalseAllow) {
|
||||
this.conditionAndAlwayFalseAllow = conditionAndAlwayFalseAllow;
|
||||
}
|
||||
|
||||
public boolean isDeleteWhereAlwayTrueCheck() {
|
||||
return deleteWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck) {
|
||||
this.deleteWhereAlwayTrueCheck = deleteWhereAlwayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isUpdateWhereAlayTrueCheck() {
|
||||
return updateWhereAlayTrueCheck;
|
||||
}
|
||||
|
||||
public void setUpdateWhereAlayTrueCheck(boolean updateWhereAlayTrueCheck) {
|
||||
this.updateWhereAlayTrueCheck = updateWhereAlayTrueCheck;
|
||||
}
|
||||
|
||||
public boolean isConditionOpBitwseAllow() {
|
||||
return conditionOpBitwseAllow;
|
||||
}
|
||||
|
||||
public void setConditionOpBitwseAllow(boolean conditionOpBitwseAllow) {
|
||||
this.conditionOpBitwseAllow = conditionOpBitwseAllow;
|
||||
}
|
||||
|
||||
public void setInited(boolean inited) {
|
||||
this.inited = inited;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -37,9 +37,9 @@ public interface WallConfigMBean {
|
||||
|
||||
void setTruncateAllow(boolean truncateAllow);
|
||||
|
||||
boolean isSelectAllow();
|
||||
boolean isSelelctAllow();
|
||||
|
||||
void setSelectAllow(boolean selectAllow);
|
||||
void setSelelctAllow(boolean selelctAllow);
|
||||
|
||||
boolean isSelectIntoAllow();
|
||||
|
||||
@@ -53,29 +53,29 @@ public interface WallConfigMBean {
|
||||
|
||||
void setSelectUnionCheck(boolean selectUnionCheck);
|
||||
|
||||
boolean isSelectWhereAlwaysTrueCheck();
|
||||
boolean isSelectWhereAlwayTrueCheck();
|
||||
|
||||
void setSelectWhereAlwaysTrueCheck(boolean selectWhereAlwaysTrueCheck);
|
||||
void setSelectWhereAlwayTrueCheck(boolean selectWhereAlwayTrueCheck);
|
||||
|
||||
boolean isSelectHavingAlwaysTrueCheck();
|
||||
boolean isSelectHavingAlwayTrueCheck();
|
||||
|
||||
void setSelectHavingAlwaysTrueCheck(boolean selectHavingAlwaysTrueCheck);
|
||||
void setSelectHavingAlwayTrueCheck(boolean selectHavingAlwayTrueCheck);
|
||||
|
||||
boolean isDeleteAllow();
|
||||
|
||||
void setDeleteAllow(boolean deleteAllow);
|
||||
|
||||
boolean isDeleteWhereAlwaysTrueCheck();
|
||||
boolean isDeleteWhereAlwayTrueCheck();
|
||||
|
||||
void setDeleteWhereAlwaysTrueCheck(boolean deleteWhereAlwaysTrueCheck);
|
||||
void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck);
|
||||
|
||||
boolean isUpdateAllow();
|
||||
|
||||
void setUpdateAllow(boolean updateAllow);
|
||||
|
||||
boolean isUpdateWhereAlwaysTrueCheck();
|
||||
boolean isUpdateWhereAlayTrueCheck();
|
||||
|
||||
void setUpdateWhereAlwaysTrueCheck(boolean updateWhereAlwaysTrueCheck);
|
||||
void setUpdateWhereAlayTrueCheck(boolean updateWhereAlayTrueCheck);
|
||||
|
||||
boolean isInsertAllow();
|
||||
|
||||
|
||||
@@ -188,7 +188,7 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor
|
||||
|
||||
@Override
|
||||
public boolean visit(SQLSelectStatement x) {
|
||||
if (!config.isSelectAllow()) {
|
||||
if (!config.isSelelctAllow()) {
|
||||
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow",
|
||||
this.toSQL(x)));
|
||||
return false;
|
||||
|
||||
@@ -15,6 +15,9 @@
|
||||
*/
|
||||
package com.alibaba.druid.wall.spi;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
import com.alibaba.druid.sql.SQLUtils;
|
||||
import com.alibaba.druid.sql.ast.SQLCommentHint;
|
||||
import com.alibaba.druid.sql.ast.SQLName;
|
||||
@@ -66,9 +69,6 @@ import com.alibaba.druid.wall.spi.WallVisitorUtils.WallTopStatementContext;
|
||||
import com.alibaba.druid.wall.violation.ErrorCode;
|
||||
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor {
|
||||
|
||||
private final WallConfig config;
|
||||
@@ -197,7 +197,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
|
||||
|
||||
@Override
|
||||
public boolean visit(SQLSelectStatement x) {
|
||||
if (!config.isSelectAllow()) {
|
||||
if (!config.isSelelctAllow()) {
|
||||
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow",
|
||||
this.toSQL(x)));
|
||||
return false;
|
||||
@@ -477,6 +477,8 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
|
||||
case '|':
|
||||
case '^':
|
||||
case '\n':
|
||||
case '.':
|
||||
case '(':
|
||||
addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints",
|
||||
SQLUtils.toMySqlString(x)));
|
||||
default:
|
||||
|
||||
@@ -201,7 +201,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
|
||||
|
||||
@Override
|
||||
public boolean visit(SQLSelectStatement x) {
|
||||
if (!config.isSelectAllow()) {
|
||||
if (!config.isSelelctAllow()) {
|
||||
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow",
|
||||
this.toSQL(x)));
|
||||
return false;
|
||||
|
||||
@@ -185,7 +185,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
|
||||
|
||||
@Override
|
||||
public boolean visit(SQLSelectStatement x) {
|
||||
if (!config.isSelectAllow()) {
|
||||
if (!config.isSelelctAllow()) {
|
||||
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow",
|
||||
this.toSQL(x)));
|
||||
return false;
|
||||
|
||||
@@ -198,7 +198,7 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
|
||||
|
||||
@Override
|
||||
public boolean visit(SQLSelectStatement x) {
|
||||
if (!config.isSelectAllow()) {
|
||||
if (!config.isSelelctAllow()) {
|
||||
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow",
|
||||
this.toSQL(x)));
|
||||
return false;
|
||||
|
||||
@@ -275,7 +275,7 @@ public class WallVisitorUtils {
|
||||
where.setParent(x);
|
||||
checkCondition(visitor, x.getWhere());
|
||||
|
||||
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwaysTrueCheck());
|
||||
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
|
||||
|
||||
if (Boolean.TRUE == whereValue) {
|
||||
if (!isSimpleConstExpr(where)) {// 简单表达式
|
||||
@@ -292,7 +292,7 @@ public class WallVisitorUtils {
|
||||
return;
|
||||
}
|
||||
|
||||
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwaysTrueCheck())) {
|
||||
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
|
||||
if (!isSimpleConstExpr(x)) {
|
||||
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x);
|
||||
}
|
||||
@@ -331,7 +331,7 @@ public class WallVisitorUtils {
|
||||
if (where != null) {
|
||||
checkCondition(visitor, where);
|
||||
|
||||
if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwaysTrueCheck())) {
|
||||
if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) {
|
||||
if (!isSimpleConstExpr(where)) {
|
||||
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x);
|
||||
}
|
||||
@@ -912,7 +912,7 @@ public class WallVisitorUtils {
|
||||
where.setParent(x);
|
||||
checkCondition(visitor, where);
|
||||
|
||||
if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlwaysTrueCheck())) {
|
||||
if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) {
|
||||
if (!isSimpleConstExpr(where)) {
|
||||
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x);
|
||||
}
|
||||
@@ -1335,11 +1335,11 @@ public class WallVisitorUtils {
|
||||
}
|
||||
}
|
||||
|
||||
if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwaysTrueAllow()) {
|
||||
if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
|
||||
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x);
|
||||
}
|
||||
|
||||
if (current.hasPartAlwayFalse() && !visitor.getConfig().isConditionAndAlwaysFalseAllow()) {
|
||||
if (current.hasPartAlwayFalse() && !visitor.getConfig().isConditionAndAlwayFalseAllow()) {
|
||||
addViolation(visitor, ErrorCode.ALWAYS_FALSE, "part alway false condition not allow", x);
|
||||
}
|
||||
|
||||
@@ -1351,7 +1351,7 @@ public class WallVisitorUtils {
|
||||
addViolation(visitor, ErrorCode.XOR, "xor not allow", x);
|
||||
}
|
||||
|
||||
if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwiseAllow()) {
|
||||
if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwseAllow()) {
|
||||
addViolation(visitor, ErrorCode.BITWISE, "bitwise operator not allow", x);
|
||||
}
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ public class BitwiseAndTest extends TestCase {
|
||||
|
||||
public void test_true() throws Exception {
|
||||
WallConfig config = new WallConfig();
|
||||
config.setConditionOpBitwiseAllow(false);
|
||||
config.setConditionOpBitwseAllow(false);
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(//
|
||||
"SELECT * from t where id = 1 & 2", config)); //
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@ public class BitwiseInvertTest extends TestCase {
|
||||
|
||||
public void test_false() throws Exception {
|
||||
WallConfig config = new WallConfig();
|
||||
config.setConditionOpBitwiseAllow(false);
|
||||
config.setConditionOpBitwseAllow(false);
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(//
|
||||
"SELECT * from t where id = ~2", config)); //
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@ public class BitwiseOrTest extends TestCase {
|
||||
|
||||
public void test_false() throws Exception {
|
||||
WallConfig config = new WallConfig();
|
||||
config.setConditionOpBitwiseAllow(false);
|
||||
config.setConditionOpBitwseAllow(false);
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(//
|
||||
"SELECT * from t where id = 1 | 2", config)); //
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@ public class BitwiseXorTest extends TestCase {
|
||||
|
||||
public void test_false() throws Exception {
|
||||
WallConfig config = new WallConfig();
|
||||
config.setConditionOpBitwiseAllow(false);
|
||||
config.setConditionOpBitwseAllow(false);
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(//
|
||||
"SELECT * from t where id = 1 ^ 2", config)); //
|
||||
}
|
||||
|
||||
@@ -16,8 +16,13 @@ public class HintTest extends TestCase {
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); //
|
||||
}
|
||||
|
||||
public void test_true() throws Exception {
|
||||
public void test_false_1() throws Exception {
|
||||
String sql = "select * from person where id = '3'/**/union select 0,1,v from (select 1,2,user/*!() as v*/) a where '1'<>''";
|
||||
Assert.assertFalse(WallUtils.isValidateMySql(sql)); //
|
||||
}
|
||||
|
||||
public void test_true() throws Exception {
|
||||
String sql = "SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2";
|
||||
Assert.assertTrue(WallUtils.isValidateMySql(sql)); //
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,7 +43,7 @@ public class MySqlWallTest43 extends TestCase {
|
||||
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new MySqlWallProvider();
|
||||
provider.getConfig().setConditionAndAlwaysTrueAllow(true);
|
||||
provider.getConfig().setConditionAndAlwayTrueAllow(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"SELECT COUNT(1) AS count FROM `team` " + //
|
||||
@@ -64,7 +64,7 @@ public class MySqlWallTest43 extends TestCase {
|
||||
|
||||
public void test_true2() throws Exception {
|
||||
WallProvider provider = new MySqlWallProvider();
|
||||
provider.getConfig().setConditionAndAlwaysFalseAllow(true);
|
||||
provider.getConfig().setConditionAndAlwayFalseAllow(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"SELECT COUNT(1) AS count FROM `team` " + //
|
||||
|
||||
@@ -34,7 +34,7 @@ public class MySqlWallTest89 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new MySqlWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"select login('', '', 'guest', '47ea3937793101011caaa5dd88d3bcae926526624796b8a26a9615e8d3bea6b4', 'iPad3,4', 'unknown'), '', (select max(num) from accounts) + @@auto_increment_increment"));
|
||||
|
||||
@@ -34,7 +34,7 @@ public class MySqlWallTest90 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new MySqlWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"select * from (select t10006_men_xing_jia_ge_fen_lei.bian_hao as \"bian_hao\", " + //
|
||||
|
||||
@@ -36,7 +36,7 @@ public class MySqlWallTest91 extends TestCase {
|
||||
|
||||
provider.getConfig().setStrictSyntaxCheck(false);
|
||||
provider.getConfig().setMultiStatementAllow(true);
|
||||
provider.getConfig().setConditionAndAlwaysTrueAllow(true);
|
||||
provider.getConfig().setConditionAndAlwayTrueAllow(true);
|
||||
provider.getConfig().setNoneBaseStatementAllow(true);
|
||||
provider.getConfig().setLimitZeroAllow(true);
|
||||
provider.getConfig().setConditionDoubleConstAllow(true);
|
||||
|
||||
@@ -27,7 +27,7 @@ public class MySqlWallTest_concat extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new MySqlWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''"));
|
||||
|
||||
@@ -36,7 +36,7 @@ public class SQLServerWallTest_0 extends TestCase {
|
||||
|
||||
provider.getConfig().setStrictSyntaxCheck(false);
|
||||
provider.getConfig().setMultiStatementAllow(true);
|
||||
provider.getConfig().setConditionAndAlwaysTrueAllow(true);
|
||||
provider.getConfig().setConditionAndAlwayTrueAllow(true);
|
||||
provider.getConfig().setNoneBaseStatementAllow(true);
|
||||
provider.getConfig().setLimitZeroAllow(true);
|
||||
provider.getConfig().setConditionDoubleConstAllow(true);
|
||||
|
||||
@@ -34,7 +34,7 @@ public class SQLServerWallTest_3 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new SQLServerWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertFalse(provider.checkValid(//
|
||||
"select * from t where LEN(HOST_NAME()) > 0"));
|
||||
|
||||
@@ -34,7 +34,7 @@ public class SQLServerWallTest_4 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new SQLServerWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"insert into t (fid, name) values (1, HOST_NAME())"));
|
||||
|
||||
@@ -34,7 +34,7 @@ public class SQLServerWallTest_5 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new SQLServerWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertFalse(provider.checkValid(//
|
||||
"delete t where LEN(HOST_NAME()) > 0"));
|
||||
|
||||
@@ -34,7 +34,7 @@ public class SQLServerWallTest_6 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new SQLServerWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertFalse(provider.checkValid(//
|
||||
"update t set fid = 1 where LEN(HOST_NAME()) > 0"));
|
||||
|
||||
@@ -34,7 +34,7 @@ public class SQLServerWallTest_7 extends TestCase {
|
||||
public void test_true() throws Exception {
|
||||
WallProvider provider = new SQLServerWallProvider();
|
||||
|
||||
provider.getConfig().setSelectHavingAlwaysTrueCheck(true);
|
||||
provider.getConfig().setSelectHavingAlwayTrueCheck(true);
|
||||
|
||||
Assert.assertTrue(provider.checkValid(//
|
||||
"select * from (select top 3000 jol.id as primaryKeyIds, jo.orderNo as 委托单号, bm.custname as 委托方名称, manuCustInfo.custname as 出证方, jo.chkerDate as 委托日期, bcc.connectName as 联系人, bcc.mobile as 电话,jol.barcode as 样品条码, jol.name as 样品名称, jol.qtysub as 套件数量,jol.OnlyCode as 唯一识别码,jol.manufacture as 制造厂商,jol.sprc as 规格型号, jol.outno as 出厂编号, djod.name as 任务状态, djoc.name 委托类别, dct.name as 证书类型,bdp.organ_name as 分配室组, jol.task_id as 任务ID, be.user_name as 检定人员, verifyUser.user_name as 核验员, checkUser.user_name as 批准员, jol.ddate 交款日期,cjcs.name as 缴款状态, jc.moneys as 应收费, jc.moneystotal as 实收费, be.organ_id from jl_OrderList jol left outer join jl_CheckList jc on jol.checkList_id = jc.id left outer join jl_Order jo on jol.orderid = jo.id left outer join ba_dptinfo bdp on jol.dptid = bdp.id left outer join jl_Task jt on jol.task_id = jt.id left outer join ba_manucustinfo bm on jo.entrustCustId = bm.id left outer join ba_manucustinfo manuCustInfo on jo.custid = manuCustInfo.id left outer join ba_custconnect bcc on jo.linkPerson = bcc.id left outer join ba_employeeinfo be on jt.jdUserId = be.id left outer join ba_employeeinfo verifyUser on jt.verifyUser = verifyUser.id left outer join ba_employeeinfo checkUser on jt.checkUser = checkUser.id left outer join dict_jl_order_doType djod on jol.dotypeid = djod.id left outer join dict_jl_order_class djoc on jo.orderclassid = djoc.id left outer join dict_certificate_type dct on jt.certificatetype = dct.id left outer join dict_jl_chargestatus cjcs on jol.chargestatus = cjcs.id where jol.id >= (select min(primaryKeyId) from (select top 3000 jol.id as primaryKeyId from jl_OrderList jol left outer join jl_CheckList jc on jol.checkList_id = jc.id left outer join jl_Order jo on jol.orderid = jo.id left outer join ba_dptinfo bdp on jol.dptid = bdp.id left outer join jl_Task jt on jol.task_id = jt.id left outer join ba_manucustinfo bm on jo.entrustCustId = bm.id left outer join ba_manucustinfo manuCustInfo on jo.custid = manuCustInfo.id left outer join ba_custconnect bcc on jo.linkPerson = bcc.id left outer join ba_employeeinfo be on jt.jdUserId = be.id left outer join ba_employeeinfo verifyUser on jt.verifyUser = verifyUser.id left outer join ba_employeeinfo checkUser on jt.checkUser = checkUser.id left outer join dict_jl_order_doType djod on jol.dotypeid = djod.id left outer join dict_jl_order_class djoc on jo.orderclassid = djoc.id left outer join dict_certificate_type dct on jt.certificatetype = dct.id left outer join dict_jl_chargestatus cjcs on jol.chargestatus = cjcs.id where jo.chkerDate >= ? and jo.chkerDate <= ? and jol.ddate >= ? order by jol.id desc, jo.id DESC) as T) and jo.chkerDate >= ? and jo.chkerDate <= ? and jol.ddate >= ? order by jol.id asc, jo.id DESC) as T1 order by T1.primaryKeyIds desc"));
|
||||
|
||||
@@ -47,7 +47,7 @@ public class MySqlResourceWallTest extends TestCase {
|
||||
provider.getConfig().setUseAllow(true);
|
||||
provider.getConfig().setStrictSyntaxCheck(false);
|
||||
provider.getConfig().setMultiStatementAllow(true);
|
||||
provider.getConfig().setConditionAndAlwaysTrueAllow(true);
|
||||
provider.getConfig().setConditionAndAlwayTrueAllow(true);
|
||||
provider.getConfig().setNoneBaseStatementAllow(true);
|
||||
provider.getConfig().setSelectUnionCheck(false);
|
||||
provider.getConfig().setSchemaCheck(true);
|
||||
|
||||
Reference in New Issue
Block a user