From 8a858b9549ee9f8d8b6dfcdfa79a283bc18745d1 Mon Sep 17 00:00:00 2001 From: Yako Date: Wed, 27 Aug 2014 14:22:23 +0800 Subject: [PATCH 1/2] improve sqlwall --- src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index dc1c7cd789..57b319966b 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -477,6 +477,8 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi case '|': case '^': case '\n': + case '.': + case '(': addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); default: From eb928486c8200a0d3e9b9ff15da2d4d392a5e296 Mon Sep 17 00:00:00 2001 From: Yako Date: Thu, 28 Aug 2014 16:21:41 +0800 Subject: [PATCH 2/2] revert wallconfig --- .../com/alibaba/druid/wall/WallConfig.java | 150 +++++++++--------- .../alibaba/druid/wall/WallConfigMBean.java | 20 +-- .../druid/wall/spi/DB2WallVisitor.java | 2 +- .../druid/wall/spi/MySqlWallVisitor.java | 8 +- .../druid/wall/spi/OracleWallVisitor.java | 2 +- .../alibaba/druid/wall/spi/PGWallVisitor.java | 2 +- .../druid/wall/spi/SQLServerWallVisitor.java | 2 +- .../druid/wall/spi/WallVisitorUtils.java | 14 +- .../druid/bvt/filter/wall/BitwiseAndTest.java | 2 +- .../bvt/filter/wall/BitwiseInvertTest.java | 2 +- .../druid/bvt/filter/wall/BitwiseOrTest.java | 2 +- .../druid/bvt/filter/wall/BitwiseXorTest.java | 2 +- .../druid/bvt/filter/wall/HintTest.java | 7 +- .../bvt/filter/wall/MySqlWallTest43.java | 4 +- .../bvt/filter/wall/MySqlWallTest89.java | 2 +- .../bvt/filter/wall/MySqlWallTest90.java | 2 +- .../bvt/filter/wall/MySqlWallTest91.java | 2 +- .../bvt/filter/wall/MySqlWallTest_concat.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_0.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_3.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_4.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_5.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_6.java | 2 +- .../bvt/filter/wall/SQLServerWallTest_7.java | 2 +- .../test/wall/MySqlResourceWallTest.java | 2 +- 25 files changed, 125 insertions(+), 116 deletions(-) diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 533dee5c0d..f17a733da2 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -27,11 +27,11 @@ public class WallConfig implements WallConfigMBean { private boolean noneBaseStatementAllow = false; private boolean callAllow = true; - private boolean selectAllow = true; + private boolean selelctAllow = true; private boolean selectIntoAllow = true; private boolean selectIntoOutfileAllow = false; - private boolean selectWhereAlwaysTrueCheck = true; - private boolean selectHavingAlwaysTrueCheck = true; + private boolean selectWhereAlwayTrueCheck = true; + private boolean selectHavingAlwayTrueCheck = true; private boolean selectUnionCheck = true; private boolean selectMinusCheck = true; private boolean selectExceptCheck = true; @@ -42,19 +42,19 @@ public class WallConfig implements WallConfigMBean { private boolean renameTableAllow = true; private boolean hintAllow = true; - private boolean conditionAndAlwaysTrueAllow = false; - private boolean conditionAndAlwaysFalseAllow = false; + private boolean conditionAndAlwayTrueAllow = false; + private boolean conditionAndAlwayFalseAllow = false; private boolean conditionDoubleConstAllow = false; private boolean conditionLikeTrueAllow = true; private boolean selectAllColumnAllow = true; private boolean deleteAllow = true; - private boolean deleteWhereAlwaysTrueCheck = true; + private boolean deleteWhereAlwayTrueCheck = true; private boolean deleteWhereNoneCheck = false; private boolean updateAllow = true; - private boolean updateWhereAlwaysTrueCheck = true; + private boolean updateWhereAlayTrueCheck = true; private boolean updateWhereNoneCheck = false; private boolean insertAllow = true; @@ -114,7 +114,7 @@ public class WallConfig implements WallConfigMBean { private boolean metadataAllow = true; private boolean conditionOpXorAllow = false; - private boolean conditionOpBitwiseAllow = true; + private boolean conditionOpBitwseAllow = true; private boolean caseConditionConstAllow = false; @@ -154,22 +154,6 @@ public class WallConfig implements WallConfigMBean { this.limitZeroAllow = limitZero; } - public boolean isConditionAndAlwaysTrueAllow() { - return conditionAndAlwaysTrueAllow; - } - - public void setConditionAndAlwaysTrueAllow(boolean conditionAndAlwaysTrueAllow) { - this.conditionAndAlwaysTrueAllow = conditionAndAlwaysTrueAllow; - } - - public boolean isConditionAndAlwaysFalseAllow() { - return conditionAndAlwaysFalseAllow; - } - - public void setConditionAndAlwaysFalseAllow(boolean conditionAndAlwaysFalseAllow) { - this.conditionAndAlwaysFalseAllow = conditionAndAlwaysFalseAllow; - } - public boolean isUseAllow() { return useAllow; } @@ -218,14 +202,6 @@ public class WallConfig implements WallConfigMBean { this.conditionOpXorAllow = conditionOpXorAllow; } - public boolean isConditionOpBitwiseAllow() { - return conditionOpBitwiseAllow; - } - - public void setConditionOpBitwiseAllow(boolean conditionOpBitwiseAllow) { - this.conditionOpBitwiseAllow = conditionOpBitwiseAllow; - } - public String getTenantTablePattern() { return tenantTablePattern; } @@ -365,14 +341,6 @@ public class WallConfig implements WallConfigMBean { this.truncateAllow = truncateAllow; } - public boolean isSelectAllow() { - return selectAllow; - } - - public void setSelectAllow(boolean selelctAllow) { - this.selectAllow = selelctAllow; - } - public boolean isSelectIntoAllow() { return selectIntoAllow; } @@ -453,22 +421,6 @@ public class WallConfig implements WallConfigMBean { this.selectIntersectCheck = selectIntersectCheck; } - public boolean isSelectWhereAlwaysTrueCheck() { - return selectWhereAlwaysTrueCheck; - } - - public void setSelectWhereAlwaysTrueCheck(boolean selectWhereAlwayTrueCheck) { - this.selectWhereAlwaysTrueCheck = selectWhereAlwayTrueCheck; - } - - public boolean isSelectHavingAlwaysTrueCheck() { - return selectHavingAlwaysTrueCheck; - } - - public void setSelectHavingAlwaysTrueCheck(boolean selectHavingAlwayTrueCheck) { - this.selectHavingAlwaysTrueCheck = selectHavingAlwayTrueCheck; - } - public boolean isDeleteAllow() { return deleteAllow; } @@ -477,14 +429,6 @@ public class WallConfig implements WallConfigMBean { this.deleteAllow = deleteAllow; } - public boolean isDeleteWhereAlwaysTrueCheck() { - return deleteWhereAlwaysTrueCheck; - } - - public void setDeleteWhereAlwaysTrueCheck(boolean deleteWhereAlwayTrueCheck) { - this.deleteWhereAlwaysTrueCheck = deleteWhereAlwayTrueCheck; - } - public boolean isDeleteWhereNoneCheck() { return deleteWhereNoneCheck; } @@ -501,14 +445,6 @@ public class WallConfig implements WallConfigMBean { this.updateAllow = updateAllow; } - public boolean isUpdateWhereAlwaysTrueCheck() { - return updateWhereAlwaysTrueCheck; - } - - public void setUpdateWhereAlwaysTrueCheck(boolean updateWhereAlayTrueCheck) { - this.updateWhereAlwaysTrueCheck = updateWhereAlayTrueCheck; - } - public boolean isUpdateWhereNoneCheck() { return updateWhereNoneCheck; } @@ -713,7 +649,7 @@ public class WallConfig implements WallConfigMBean { public void setCallAllow(boolean callAllow) { this.callAllow = callAllow; } - + public boolean isHintAllow() { return hintAllow; } @@ -748,4 +684,72 @@ public class WallConfig implements WallConfigMBean { void filterResultsetTenantColumn(Object value); } + public boolean isSelelctAllow() { + return selelctAllow; + } + + public void setSelelctAllow(boolean selelctAllow) { + this.selelctAllow = selelctAllow; + } + + public boolean isSelectWhereAlwayTrueCheck() { + return selectWhereAlwayTrueCheck; + } + + public void setSelectWhereAlwayTrueCheck(boolean selectWhereAlwayTrueCheck) { + this.selectWhereAlwayTrueCheck = selectWhereAlwayTrueCheck; + } + + public boolean isSelectHavingAlwayTrueCheck() { + return selectHavingAlwayTrueCheck; + } + + public void setSelectHavingAlwayTrueCheck(boolean selectHavingAlwayTrueCheck) { + this.selectHavingAlwayTrueCheck = selectHavingAlwayTrueCheck; + } + + public boolean isConditionAndAlwayTrueAllow() { + return conditionAndAlwayTrueAllow; + } + + public void setConditionAndAlwayTrueAllow(boolean conditionAndAlwayTrueAllow) { + this.conditionAndAlwayTrueAllow = conditionAndAlwayTrueAllow; + } + + public boolean isConditionAndAlwayFalseAllow() { + return conditionAndAlwayFalseAllow; + } + + public void setConditionAndAlwayFalseAllow(boolean conditionAndAlwayFalseAllow) { + this.conditionAndAlwayFalseAllow = conditionAndAlwayFalseAllow; + } + + public boolean isDeleteWhereAlwayTrueCheck() { + return deleteWhereAlwayTrueCheck; + } + + public void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck) { + this.deleteWhereAlwayTrueCheck = deleteWhereAlwayTrueCheck; + } + + public boolean isUpdateWhereAlayTrueCheck() { + return updateWhereAlayTrueCheck; + } + + public void setUpdateWhereAlayTrueCheck(boolean updateWhereAlayTrueCheck) { + this.updateWhereAlayTrueCheck = updateWhereAlayTrueCheck; + } + + public boolean isConditionOpBitwseAllow() { + return conditionOpBitwseAllow; + } + + public void setConditionOpBitwseAllow(boolean conditionOpBitwseAllow) { + this.conditionOpBitwseAllow = conditionOpBitwseAllow; + } + + public void setInited(boolean inited) { + this.inited = inited; + } + } diff --git a/src/main/java/com/alibaba/druid/wall/WallConfigMBean.java b/src/main/java/com/alibaba/druid/wall/WallConfigMBean.java index f457fe79c3..108eee17ac 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfigMBean.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfigMBean.java @@ -37,9 +37,9 @@ public interface WallConfigMBean { void setTruncateAllow(boolean truncateAllow); - boolean isSelectAllow(); + boolean isSelelctAllow(); - void setSelectAllow(boolean selectAllow); + void setSelelctAllow(boolean selelctAllow); boolean isSelectIntoAllow(); @@ -53,29 +53,29 @@ public interface WallConfigMBean { void setSelectUnionCheck(boolean selectUnionCheck); - boolean isSelectWhereAlwaysTrueCheck(); + boolean isSelectWhereAlwayTrueCheck(); - void setSelectWhereAlwaysTrueCheck(boolean selectWhereAlwaysTrueCheck); + void setSelectWhereAlwayTrueCheck(boolean selectWhereAlwayTrueCheck); - boolean isSelectHavingAlwaysTrueCheck(); + boolean isSelectHavingAlwayTrueCheck(); - void setSelectHavingAlwaysTrueCheck(boolean selectHavingAlwaysTrueCheck); + void setSelectHavingAlwayTrueCheck(boolean selectHavingAlwayTrueCheck); boolean isDeleteAllow(); void setDeleteAllow(boolean deleteAllow); - boolean isDeleteWhereAlwaysTrueCheck(); + boolean isDeleteWhereAlwayTrueCheck(); - void setDeleteWhereAlwaysTrueCheck(boolean deleteWhereAlwaysTrueCheck); + void setDeleteWhereAlwayTrueCheck(boolean deleteWhereAlwayTrueCheck); boolean isUpdateAllow(); void setUpdateAllow(boolean updateAllow); - boolean isUpdateWhereAlwaysTrueCheck(); + boolean isUpdateWhereAlayTrueCheck(); - void setUpdateWhereAlwaysTrueCheck(boolean updateWhereAlwaysTrueCheck); + void setUpdateWhereAlayTrueCheck(boolean updateWhereAlayTrueCheck); boolean isInsertAllow(); diff --git a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java index e089502289..7d93da8754 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java @@ -188,7 +188,7 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor @Override public boolean visit(SQLSelectStatement x) { - if (!config.isSelectAllow()) { + if (!config.isSelelctAllow()) { this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", this.toSQL(x))); return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 57b319966b..24139ee1b0 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -15,6 +15,9 @@ */ package com.alibaba.druid.wall.spi; +import java.util.ArrayList; +import java.util.List; + import com.alibaba.druid.sql.SQLUtils; import com.alibaba.druid.sql.ast.SQLCommentHint; import com.alibaba.druid.sql.ast.SQLName; @@ -66,9 +69,6 @@ import com.alibaba.druid.wall.spi.WallVisitorUtils.WallTopStatementContext; import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; -import java.util.ArrayList; -import java.util.List; - public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor { private final WallConfig config; @@ -197,7 +197,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(SQLSelectStatement x) { - if (!config.isSelectAllow()) { + if (!config.isSelelctAllow()) { this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x))); return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java index 136a785537..8484d29b45 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java @@ -201,7 +201,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi @Override public boolean visit(SQLSelectStatement x) { - if (!config.isSelectAllow()) { + if (!config.isSelelctAllow()) { this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x))); return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java index 3d08bffac1..92eb817aae 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java @@ -185,7 +185,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { @Override public boolean visit(SQLSelectStatement x) { - if (!config.isSelectAllow()) { + if (!config.isSelelctAllow()) { this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", this.toSQL(x))); return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index ae67c4577b..3d897c6009 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -198,7 +198,7 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements @Override public boolean visit(SQLSelectStatement x) { - if (!config.isSelectAllow()) { + if (!config.isSelelctAllow()) { this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", this.toSQL(x))); return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 40296c3ffb..d667f1b11e 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -275,7 +275,7 @@ public class WallVisitorUtils { where.setParent(x); checkCondition(visitor, x.getWhere()); - Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwaysTrueCheck()); + Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); if (Boolean.TRUE == whereValue) { if (!isSimpleConstExpr(where)) {// 简单表达式 @@ -292,7 +292,7 @@ public class WallVisitorUtils { return; } - if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwaysTrueCheck())) { + if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { if (!isSimpleConstExpr(x)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x); } @@ -331,7 +331,7 @@ public class WallVisitorUtils { if (where != null) { checkCondition(visitor, where); - if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwaysTrueCheck())) { + if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) { if (!isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x); } @@ -912,7 +912,7 @@ public class WallVisitorUtils { where.setParent(x); checkCondition(visitor, where); - if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlwaysTrueCheck())) { + if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) { if (!isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x); } @@ -1335,11 +1335,11 @@ public class WallVisitorUtils { } } - if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwaysTrueAllow()) { + if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x); } - if (current.hasPartAlwayFalse() && !visitor.getConfig().isConditionAndAlwaysFalseAllow()) { + if (current.hasPartAlwayFalse() && !visitor.getConfig().isConditionAndAlwayFalseAllow()) { addViolation(visitor, ErrorCode.ALWAYS_FALSE, "part alway false condition not allow", x); } @@ -1351,7 +1351,7 @@ public class WallVisitorUtils { addViolation(visitor, ErrorCode.XOR, "xor not allow", x); } - if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwiseAllow()) { + if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwseAllow()) { addViolation(visitor, ErrorCode.BITWISE, "bitwise operator not allow", x); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseAndTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseAndTest.java index f6b7af5c4c..d4acbf29f8 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseAndTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseAndTest.java @@ -16,7 +16,7 @@ public class BitwiseAndTest extends TestCase { public void test_true() throws Exception { WallConfig config = new WallConfig(); - config.setConditionOpBitwiseAllow(false); + config.setConditionOpBitwseAllow(false); Assert.assertFalse(WallUtils.isValidateMySql(// "SELECT * from t where id = 1 & 2", config)); // } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseInvertTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseInvertTest.java index 93af19fa07..c00e8c5e84 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseInvertTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseInvertTest.java @@ -16,7 +16,7 @@ public class BitwiseInvertTest extends TestCase { public void test_false() throws Exception { WallConfig config = new WallConfig(); - config.setConditionOpBitwiseAllow(false); + config.setConditionOpBitwseAllow(false); Assert.assertFalse(WallUtils.isValidateMySql(// "SELECT * from t where id = ~2", config)); // } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseOrTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseOrTest.java index b3866d5c92..32769b22ae 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseOrTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseOrTest.java @@ -16,7 +16,7 @@ public class BitwiseOrTest extends TestCase { public void test_false() throws Exception { WallConfig config = new WallConfig(); - config.setConditionOpBitwiseAllow(false); + config.setConditionOpBitwseAllow(false); Assert.assertFalse(WallUtils.isValidateMySql(// "SELECT * from t where id = 1 | 2", config)); // } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseXorTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseXorTest.java index 0773d9c858..f2ffa20853 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseXorTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/BitwiseXorTest.java @@ -16,7 +16,7 @@ public class BitwiseXorTest extends TestCase { public void test_false() throws Exception { WallConfig config = new WallConfig(); - config.setConditionOpBitwiseAllow(false); + config.setConditionOpBitwseAllow(false); Assert.assertFalse(WallUtils.isValidateMySql(// "SELECT * from t where id = 1 ^ 2", config)); // } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/HintTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/HintTest.java index 306cc35540..87d520a19e 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/HintTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/HintTest.java @@ -16,8 +16,13 @@ public class HintTest extends TestCase { Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); // } - public void test_true() throws Exception { + public void test_false_1() throws Exception { String sql = "select * from person where id = '3'/**/union select 0,1,v from (select 1,2,user/*!() as v*/) a where '1'<>''"; + Assert.assertFalse(WallUtils.isValidateMySql(sql)); // + } + + public void test_true() throws Exception { + String sql = "SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2"; Assert.assertTrue(WallUtils.isValidateMySql(sql)); // } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java index 4e51c0748b..aeac2c5801 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java @@ -43,7 +43,7 @@ public class MySqlWallTest43 extends TestCase { public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setConditionAndAlwaysTrueAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); Assert.assertTrue(provider.checkValid(// "SELECT COUNT(1) AS count FROM `team` " + // @@ -64,7 +64,7 @@ public class MySqlWallTest43 extends TestCase { public void test_true2() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setConditionAndAlwaysFalseAllow(true); + provider.getConfig().setConditionAndAlwayFalseAllow(true); Assert.assertTrue(provider.checkValid(// "SELECT COUNT(1) AS count FROM `team` " + // diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java index 40b69a0e6b..e0ce6035b6 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java @@ -34,7 +34,7 @@ public class MySqlWallTest89 extends TestCase { public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertTrue(provider.checkValid(// "select login('', '', 'guest', '47ea3937793101011caaa5dd88d3bcae926526624796b8a26a9615e8d3bea6b4', 'iPad3,4', 'unknown'), '', (select max(num) from accounts) + @@auto_increment_increment")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java index 5a97422a26..81c802fccb 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java @@ -34,7 +34,7 @@ public class MySqlWallTest90 extends TestCase { public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertTrue(provider.checkValid(// "select * from (select t10006_men_xing_jia_ge_fen_lei.bian_hao as \"bian_hao\", " + // diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java index 86621688e8..3b56f8818a 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -36,7 +36,7 @@ public class MySqlWallTest91 extends TestCase { provider.getConfig().setStrictSyntaxCheck(false); provider.getConfig().setMultiStatementAllow(true); - provider.getConfig().setConditionAndAlwaysTrueAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); provider.getConfig().setNoneBaseStatementAllow(true); provider.getConfig().setLimitZeroAllow(true); provider.getConfig().setConditionDoubleConstAllow(true); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_concat.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_concat.java index 8894367711..350186435e 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_concat.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_concat.java @@ -27,7 +27,7 @@ public class MySqlWallTest_concat extends TestCase { public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertTrue(provider.checkValid(// "select * from tb_product_word where name='' or CONCAT(name,style)='' or CONCAT(shop,style)='' or CONCAT(ename,style)=''")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java index c0d3a06d3a..45e59d220a 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java @@ -36,7 +36,7 @@ public class SQLServerWallTest_0 extends TestCase { provider.getConfig().setStrictSyntaxCheck(false); provider.getConfig().setMultiStatementAllow(true); - provider.getConfig().setConditionAndAlwaysTrueAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); provider.getConfig().setNoneBaseStatementAllow(true); provider.getConfig().setLimitZeroAllow(true); provider.getConfig().setConditionDoubleConstAllow(true); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_3.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_3.java index be50d3c419..5a9274f274 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_3.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_3.java @@ -34,7 +34,7 @@ public class SQLServerWallTest_3 extends TestCase { public void test_true() throws Exception { WallProvider provider = new SQLServerWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertFalse(provider.checkValid(// "select * from t where LEN(HOST_NAME()) > 0")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_4.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_4.java index 0b0d1c5e0a..d8a31b7f98 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_4.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_4.java @@ -34,7 +34,7 @@ public class SQLServerWallTest_4 extends TestCase { public void test_true() throws Exception { WallProvider provider = new SQLServerWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertTrue(provider.checkValid(// "insert into t (fid, name) values (1, HOST_NAME())")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_5.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_5.java index 1fcd114e97..55c8a2af05 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_5.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_5.java @@ -34,7 +34,7 @@ public class SQLServerWallTest_5 extends TestCase { public void test_true() throws Exception { WallProvider provider = new SQLServerWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertFalse(provider.checkValid(// "delete t where LEN(HOST_NAME()) > 0")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_6.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_6.java index 6396c40f91..75968fbdd9 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_6.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_6.java @@ -34,7 +34,7 @@ public class SQLServerWallTest_6 extends TestCase { public void test_true() throws Exception { WallProvider provider = new SQLServerWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertFalse(provider.checkValid(// "update t set fid = 1 where LEN(HOST_NAME()) > 0")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_7.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_7.java index ca4ebab2ff..865e489d08 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_7.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_7.java @@ -34,7 +34,7 @@ public class SQLServerWallTest_7 extends TestCase { public void test_true() throws Exception { WallProvider provider = new SQLServerWallProvider(); - provider.getConfig().setSelectHavingAlwaysTrueCheck(true); + provider.getConfig().setSelectHavingAlwayTrueCheck(true); Assert.assertTrue(provider.checkValid(// "select * from (select top 3000 jol.id as primaryKeyIds, jo.orderNo as 委托单号, bm.custname as 委托方名称, manuCustInfo.custname as 出证方, jo.chkerDate as 委托日期, bcc.connectName as 联系人, bcc.mobile as 电话,jol.barcode as 样品条码, jol.name as 样品名称, jol.qtysub as 套件数量,jol.OnlyCode as 唯一识别码,jol.manufacture as 制造厂商,jol.sprc as 规格型号, jol.outno as 出厂编号, djod.name as 任务状态, djoc.name 委托类别, dct.name as 证书类型,bdp.organ_name as 分配室组, jol.task_id as 任务ID, be.user_name as 检定人员, verifyUser.user_name as 核验员, checkUser.user_name as 批准员, jol.ddate 交款日期,cjcs.name as 缴款状态, jc.moneys as 应收费, jc.moneystotal as 实收费, be.organ_id from jl_OrderList jol left outer join jl_CheckList jc on jol.checkList_id = jc.id left outer join jl_Order jo on jol.orderid = jo.id left outer join ba_dptinfo bdp on jol.dptid = bdp.id left outer join jl_Task jt on jol.task_id = jt.id left outer join ba_manucustinfo bm on jo.entrustCustId = bm.id left outer join ba_manucustinfo manuCustInfo on jo.custid = manuCustInfo.id left outer join ba_custconnect bcc on jo.linkPerson = bcc.id left outer join ba_employeeinfo be on jt.jdUserId = be.id left outer join ba_employeeinfo verifyUser on jt.verifyUser = verifyUser.id left outer join ba_employeeinfo checkUser on jt.checkUser = checkUser.id left outer join dict_jl_order_doType djod on jol.dotypeid = djod.id left outer join dict_jl_order_class djoc on jo.orderclassid = djoc.id left outer join dict_certificate_type dct on jt.certificatetype = dct.id left outer join dict_jl_chargestatus cjcs on jol.chargestatus = cjcs.id where jol.id >= (select min(primaryKeyId) from (select top 3000 jol.id as primaryKeyId from jl_OrderList jol left outer join jl_CheckList jc on jol.checkList_id = jc.id left outer join jl_Order jo on jol.orderid = jo.id left outer join ba_dptinfo bdp on jol.dptid = bdp.id left outer join jl_Task jt on jol.task_id = jt.id left outer join ba_manucustinfo bm on jo.entrustCustId = bm.id left outer join ba_manucustinfo manuCustInfo on jo.custid = manuCustInfo.id left outer join ba_custconnect bcc on jo.linkPerson = bcc.id left outer join ba_employeeinfo be on jt.jdUserId = be.id left outer join ba_employeeinfo verifyUser on jt.verifyUser = verifyUser.id left outer join ba_employeeinfo checkUser on jt.checkUser = checkUser.id left outer join dict_jl_order_doType djod on jol.dotypeid = djod.id left outer join dict_jl_order_class djoc on jo.orderclassid = djoc.id left outer join dict_certificate_type dct on jt.certificatetype = dct.id left outer join dict_jl_chargestatus cjcs on jol.chargestatus = cjcs.id where jo.chkerDate >= ? and jo.chkerDate <= ? and jol.ddate >= ? order by jol.id desc, jo.id DESC) as T) and jo.chkerDate >= ? and jo.chkerDate <= ? and jol.ddate >= ? order by jol.id asc, jo.id DESC) as T1 order by T1.primaryKeyIds desc")); diff --git a/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java b/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java index 194cb55933..881354509f 100644 --- a/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java +++ b/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java @@ -47,7 +47,7 @@ public class MySqlResourceWallTest extends TestCase { provider.getConfig().setUseAllow(true); provider.getConfig().setStrictSyntaxCheck(false); provider.getConfig().setMultiStatementAllow(true); - provider.getConfig().setConditionAndAlwaysTrueAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); provider.getConfig().setNoneBaseStatementAllow(true); provider.getConfig().setSelectUnionCheck(false); provider.getConfig().setSchemaCheck(true);