From 4dfa7fb8b62462c87e7b01fe2b91df24c71a9c46 Mon Sep 17 00:00:00 2001 From: xiusiyan Date: Sun, 18 Mar 2012 22:16:05 +0800 Subject: [PATCH] refactor --- .../druid/wall/oracle/permit-function.txt | 6 ++-- .../druid/wall/sqlserver/permit-function.txt | 8 ++++- .../druid/wall/sqlserver/permit-object.txt | 2 ++ .../druid/wall/sqlserver/permit-variant.txt | 1 + .../wall/SQLServerWallPermitFunctionTest.java | 32 +++++++++++++++---- .../wall/SQLServerWallPermitTableTest.java | 5 +-- 6 files changed, 40 insertions(+), 14 deletions(-) diff --git a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt index f701d3f1dd..ebbdd42dfd 100644 --- a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt @@ -1,4 +1,4 @@ -SYS_CONTEXT -USERENV -SYS_GUID +SYS_CONTEXT +USERENV +SYS_GUID SYS_TYPEID \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt index c4604b68df..60e74475dc 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt @@ -1,3 +1,9 @@ EXECUTE EXEC -sp_executesql \ No newline at end of file +sp_executesql +user_name +is_srvrolemember +system_user +DB_NAME +HOST_NAME +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt index e69de29bb2..fda7909c8f 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt @@ -0,0 +1,2 @@ +user +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt index e69de29bb2..ca291e9654 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt @@ -0,0 +1 @@ +version \ No newline at end of file diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 8423f3b4d3..b30fdca15f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -38,21 +38,38 @@ public class SQLServerWallPermitFunctionTest extends TestCase { public void test01() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name();")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + + public final void test_sp_addsrvrolemenber() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); + } + + public final void test_sp_helpdb() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master")); Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs")); } + public final void test_sp_droplogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + public final void test_sp_addlogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); + } + + public final void test_db_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); + } + + public final void test_host_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); + } + /** * 测试权限结构 * @throws Exception */ - public void test02() throws Exception { + public void test_is_srvrolemember() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);")); @@ -65,4 +82,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); ")); } + public void test_system_user() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java index 2f20d53513..47d2a41d21 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java @@ -19,10 +19,7 @@ public class SQLServerWallPermitTableTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases")); } - public void test02() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); - } - + public void test03() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));