Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sqlwall rule

Browse Source
This commit is contained in:
kiki
2013-09-26 14:50:10 +08:00
parent 6df2cc1b06
commit 3347beea7b
24 changed files with 342 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/alibaba/druid/bvt/filter/wall/BigSqlTest.java
+7 -1
View File
File diff suppressed because one or more lines are too long
src/test/java/com/alibaba/druid/bvt/filter/wall/IntersectTest.java
+4 -4
View File
@@ -10,14 +10,14 @@ import com.alibaba.druid.wall.WallUtils;
public class IntersectTest extends TestCase {
public void test_false() throws Exception {
WallConfig config = new WallConfig();
config.setMinusAllow(false);
Assert.assertFalse(WallUtils.isValidateOracle(//
"SELECT * FROM A MINUS SELECT * FROM B")); //
"SELECT * FROM A MINUS SELECT * FROM B", config)); //
}
public void test_true() throws Exception {
WallConfig config = new WallConfig();
config.setMinusAllow(true);
Assert.assertTrue(WallUtils.isValidateOracle(//
"SELECT * FROM A MINUS SELECT * FROM B", config)); //
"SELECT * FROM A MINUS SELECT * FROM B")); //
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MinusTest.java
+5 -4
View File
@@ -10,14 +10,15 @@ import com.alibaba.druid.wall.WallUtils;
public class MinusTest extends TestCase {
public void test_false() throws Exception {
WallConfig config = new WallConfig();
config.setIntersectAllow(false);
Assert.assertFalse(WallUtils.isValidateOracle(//
"SELECT * FROM A Intersect SELECT * FROM B")); //
"SELECT * FROM A Intersect SELECT * FROM B", config)); //
}
public void test_true() throws Exception {
WallConfig config = new WallConfig();
config.setIntersectAllow(true);
Assert.assertTrue(WallUtils.isValidateOracle(//
"SELECT * FROM A Intersect SELECT * FROM B", config)); //
"SELECT * FROM A Intersect SELECT * FROM B")); //
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+5 -7
View File
@@ -34,17 +34,15 @@ public class MySqlWallTest91 extends TestCase {
private WallProvider initWallProvider() {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setUseAllow(true);
provider.getConfig().setStrictSyntaxCheck(false);
provider.getConfig().setMultiStatementAllow(true);
provider.getConfig().setConditionAndAlwayTrueAllow(true);
provider.getConfig().setNoneBaseStatementAllow(true);
provider.getConfig().setSelectUnionCheck(false);
provider.getConfig().setSchemaCheck(true);
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
provider.getConfig().setConditionLikeTrueAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setSelectUnionCheck(false);
return provider;
}
@@ -52,7 +50,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "SELECT count(*) FROM i_user_commentary WHERE item_type = 7 AND item_id = 30 AND SLEEP(5) AND is_del=0";
String sql = "SELECT t.session_id,t.voip_send,t.voip_rece,t.appid,t.begin_time,substring_index(t1.callbackUrl,':',1) AS servicetype, SUBSTRING_INDEX(substring_index(t1.callbackUrl,'/',3),'/',-1) AS hostname, CASE WHEN SUBSTR(t1.callbackUrl,-2)='**' THEN REPLACE(t1.callbackUrl,'**','OfflineMsgNotify') ELSE t1.callbackUrl END AS url FROM `im_session_info` t INNER JOIN ccp_application t1 ON t.appid=t1.appId WHERE t.end_time IS NULL AND ((DATABASE()='openser' AND t1.`status`=2) OR ((DATABASE()<>'openser') AND t1.`status` IN (1,2,3))) AND INSTR(t1.funInfo,'1004')>0 AND (0=0 OR (0>0 AND t.id<0)) ORDER BY t.id DESC LIMIT 100; ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -116,7 +114,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false8() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select * from A where id = 1 or EXTRACTVALUE(4484,CONCAT(0x5c,0x7163646371,(SELECT (CASE WHEN (4484=4484) THEN 1 ELSE 0 END)),0x7165767271))";
String sql = "select sum(payment_ft) from order_goods where order_id=72353 AND (SELECT 3791 FROM(SELECT COUNT(*),CONCAT(CHAR(58,110,106,120,58),(SELECT (CASE WHEN (3791=3791) THEN 1 ELSE 0 END)),CHAR(58,116,116,113,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)";
Assert.assertFalse(provider.checkValid(sql));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest92.java
+2 -2
View File
@@ -33,9 +33,9 @@ public class MySqlWallTest92 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
Assert.assertFalse(provider.checkValid(//
"SELECT * FROM T WHERE FID = 40 OR EXTRACTVALUE(4484,CONCAT(0x5c,0x7163646371,(SELECT (CASE WHEN (4484=4484) THEN 1 ELSE 0 END)),0x7165767271))"));
"SELECT * FROM T WHERE FID = 40 OR 1 = (SELECT (CASE WHEN (4484=4484) THEN 1 ELSE 0 END))"));
Assert.assertEquals(1, provider.getTableStats().size());
Assert.assertTrue(provider.getTableStats().containsKey("t"));
src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java
+11 -5
View File
@@ -34,17 +34,15 @@ public class SQLServerWallTest_0 extends TestCase {
private WallProvider initWallProvider() {
WallProvider provider = new SQLServerWallProvider();
provider.getConfig().setUseAllow(true);
provider.getConfig().setStrictSyntaxCheck(false);
provider.getConfig().setMultiStatementAllow(true);
provider.getConfig().setConditionAndAlwayTrueAllow(true);
provider.getConfig().setNoneBaseStatementAllow(true);
provider.getConfig().setSelectUnionCheck(false);
provider.getConfig().setSchemaCheck(true);
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
provider.getConfig().setConditionLikeTrueAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setSelectUnionCheck(false);
return provider;
}
@@ -153,6 +151,14 @@ public class SQLServerWallTest_0 extends TestCase {
}
}
public void test_true8() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select last_batch,spid=cast(spid as varchar(20)),(SELECT text FROM sys.dm_exec_sql_text(sql_handle)) AS query_text,(SELECT text FROM sys.dm_exec_sql_text(context_info)) AS query_text1,* from master..sysprocesses where dbid=db_id('heecerp') order by master..sysprocesses.last_batch desc";
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test_true() throws Exception {
WallProvider provider = initWallProvider();
{