diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index b77be5997d..319d8f78b0 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -56,7 +56,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { } public final void test_sp_addsrvrolemenber() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user� ‘sysadmin")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); } public final void test_sp_helpdb() throws Exception { @@ -65,10 +65,10 @@ public class SQLServerWallPermitFunctionTest extends TestCase { } public final void test_sp_droplogin() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user�")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); } public final void test_sp_addlogin() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user� ‘pass� ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); } public final void test_db_name() throws Exception { @@ -85,16 +85,16 @@ public class SQLServerWallPermitFunctionTest extends TestCase { * @throws Exception */ public void test_is_srvrolemember() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin�; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin� ‘sa�; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’); ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); ")); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java index c94090452e..d69fe42d97 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java @@ -54,10 +54,10 @@ public class SQLServerWallPermitSchemaTest extends TestCase { public void test_master() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password FROM master..sysxlogins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE�; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER�; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins� ‘OBJECT�;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘sa� ‘USER�;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE denylogin = 0;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE hasaccess = 1;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE isntname = 0;")); @@ -71,12 +71,12 @@ public class SQLServerWallPermitSchemaTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE dbcreator = 1;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE bulkadmin = 1;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable� ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysobjects WHERE xtype = ‘U� �use xtype = ‘V�for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U� ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = ��")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = ’1′ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysdatabases;")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name + ��+ master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password_hash FROM master.sys.sql_logins"));