Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

sql wall filter

Browse Source
This commit is contained in:
温少
2012-03-16 01:06:58 +08:00
parent 7a227726e6 52d7f659ec
commit 5943132ed3
6 changed files with 108 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java
+24 -34
View File
@@ -11,22 +11,23 @@ import com.alibaba.druid.filter.wall.WallVisitor;
import com.alibaba.druid.sql.SQLUtils;
import com.alibaba.druid.sql.ast.SQLName;
import com.alibaba.druid.sql.ast.SQLObject;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr;
import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement;
import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlExecuteStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowColumnsStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowDatabasesStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowTablesStatement;
import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor;
import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter;
public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor {
public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor {
private final Set<String> permitFunctions = new HashSet<String>();
private final Set<String> permitTables = new HashSet<String>();
@@ -79,29 +80,6 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
return violations;
}
public boolean visit(MySqlExecuteStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
return false;
}
@Override
public boolean visit(MySqlShowTablesStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
return false;
}
@Override
public boolean visit(MySqlShowDatabasesStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
return false;
}
@Override
public boolean visit(MySqlShowColumnsStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
return false;
}
public boolean visit(SQLBinaryOpExpr x) {
WallVisitorUtils.check(this, x);
@@ -122,11 +100,6 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
return visit((SQLSelectQueryBlock) x);
}
public boolean visit(SQLDropTableStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
return false;
}
public boolean visit(SQLVariantRefExpr x) {
String varName = x.getName();
if (varName == null) {
@@ -183,4 +156,21 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
return permitTables.contains(name);
}
public void preVisit(SQLObject x) {
if (!(x instanceof SQLStatement)) {
return;
}
if (x instanceof SQLInsertStatement) {
} else if (x instanceof SQLSelectStatement) {
} else if (x instanceof SQLDeleteStatement) {
} else if (x instanceof SQLUpdateStatement) {
} else {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
}
}
}
src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java
+32 -6
View File
@@ -19,12 +19,19 @@ import com.alibaba.druid.logging.LogFactory;
import com.alibaba.druid.sql.SQLUtils;
import com.alibaba.druid.sql.ast.SQLName;
import com.alibaba.druid.sql.ast.SQLObject;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMergeStatement;
import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMultiInsertStatement;
import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectTableReference;
import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVIsitorAdapter;
import com.alibaba.druid.util.JdbcUtils;
@@ -100,13 +107,12 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
name = name.toLowerCase();
permitFunctions.add(name);
}
public void addPermitTable(String name) {
name = name.toLowerCase();
permitTables.add(name);
}
public Set<String> getPermitNames() {
return permitNames;
}
@@ -155,7 +161,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
WallVisitorUtils.check(this, x);
return true;
}
public boolean visit(SQLExprTableSource x) {
WallVisitorUtils.check(this, x);
@@ -165,7 +171,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
return true;
}
@Override
public boolean visit(SQLUnionQuery x) {
if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) {
@@ -174,15 +180,35 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
return true;
}
@Override
public String toSQL(SQLObject obj) {
return SQLUtils.toOracleString(obj);
}
@Override
public boolean containsPermitTable(String name) {
name = WallVisitorUtils.form(name);
return permitTables.contains(name);
}
public void preVisit(SQLObject x) {
if (!(x instanceof SQLStatement)) {
return;
}
if (x instanceof SQLInsertStatement) {
} else if (x instanceof SQLSelectStatement) {
} else if (x instanceof SQLDeleteStatement) {
} else if (x instanceof SQLUpdateStatement) {
} else if (x instanceof OracleMultiInsertStatement) {
} else if (x instanceof OracleMergeStatement) {
} else {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
}
}
}