improve wall filter

This commit is contained in:
wenshao
2013-04-01 21:20:32 +08:00
parent 1e35c47986
commit 3f17655d1a
5 changed files with 57 additions and 16 deletions
@@ -67,6 +67,9 @@ public class SQLDeleteStatement extends SQLStatementImpl {
}
public void setWhere(SQLExpr where) {
if (where != null) {
where.setParent(this);
}
this.where = where;
}
@@ -241,7 +241,6 @@ public class WallVisitorUtils {
return;
}
x.getWhere().setParent(x);
checkCondition(visitor, x.getWhere());
checkConditionForMultiTenant(visitor, x.getWhere(), x);
}
@@ -19,6 +19,7 @@ import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
@@ -35,8 +36,23 @@ public class MySqlWallTest25 extends TestCase {
"update test.dml_health_check set id=? limit ?")); //
}
public void test_false() throws Exception {
Assert.assertFalse(WallUtils.isValidateMySql(//
public void test_true_1() throws Exception {
Assert.assertTrue(WallUtils.isValidateMySql(//
"update test.dml_health_check set id=?")); //
}
public void test_true_2() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereNoneCheck(true);
Assert.assertTrue(WallUtils.isValidateMySql(//
"update test.dml_health_check set id=? limit ?", config)); //
}
public void test_false() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereNoneCheck(true);
Assert.assertFalse(WallUtils.isValidateMySql(//
"update test.dml_health_check set id=?", config)); //
}
}
@@ -19,21 +19,37 @@ import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* 这个场景,检测可疑的Having条件
*
* @author wenshao
*
*/
public class WallDeleteWhereTest1 extends TestCase {
private String sql = "DELETE FROM T";
public void testMySql() throws Exception {
Assert.assertFalse(WallUtils.isValidateMySql(sql));
Assert.assertTrue(WallUtils.isValidateMySql(sql));
}
public void testORACLE() throws Exception {
Assert.assertFalse(WallUtils.isValidateOracle(sql));
Assert.assertTrue(WallUtils.isValidateOracle(sql));
}
public void testMySql_false() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereNoneCheck(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
}
public void testORACLE_false() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereNoneCheck(true);
Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
}
}
@@ -22,22 +22,29 @@ import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
public class WallUpdateTest2 extends TestCase {
private String sql = "UPDATE T_USER SET FNAME = ?";
private WallConfig config = new WallConfig();
protected void setUp() throws Exception {
config.setUpdateAllow(true);
public void testMySql_true() throws Exception {
WallConfig config = new WallConfig();
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
}
public void testMySql() throws Exception {
public void testORACLE_true() throws Exception {
WallConfig config = new WallConfig();
Assert.assertTrue(WallUtils.isValidateOracle(sql, config));
}
public void testMySql_false() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateAllow(false);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
}
public void testORACLE() throws Exception {
public void testORACLE_false() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateAllow(false);
Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
}
}