refactor

src/main/resources/META-INF/druid/wall/oracle/permit-function.txt

@@ -1,4 +1,4 @@
-SYS_CONTEXT
-USERENV
-SYS_GUID
+SYS_CONTEXT
+USERENV
+SYS_GUID
 SYS_TYPEID

src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt

@@ -1,3 +1,9 @@
 EXECUTE
 EXEC
-sp_executesql
+sp_executesql
+user_name
+is_srvrolemember
+system_user
+DB_NAME
+HOST_NAME
+system_user

src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt

@@ -0,0 +1,2 @@
+user
+system_user

src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt

@@ -0,0 +1 @@
+version

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java

@@ -38,21 +38,38 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
     
     public void test01() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name();"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;"));
+    }
+    
+    public final void test_sp_addsrvrolemenber() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin"));
+    }
+    
+    public final void test_sp_helpdb() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs"));
     }
     
+    public final void test_sp_droplogin() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;"));
+    }
+    public final void test_sp_addlogin() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; "));
+    }
+    
+    public final void test_db_name() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); "));
+    }
+    
+    public final void test_host_name() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()"));
+    }
+    
     /**
      * 测试权限结构
      * @throws Exception
      */
-    public void test02() throws Exception {
+    public void test_is_srvrolemember() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);"));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);"));
@@ -65,4 +82,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); "));
     }
 
+    public void test_system_user() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;"));
+    }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java

@@ -19,10 +19,7 @@ public class SQLServerWallPermitTableTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases"));
     }
     
-    public void test02() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;"));
-    }
-    
+
     public void test03() throws Exception {
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ "));
         Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));