From 5edabcbb8155331ec7b6b1f8801c96deeb8bcb62 Mon Sep 17 00:00:00 2001 From: Yako Date: Thu, 13 Nov 2014 16:26:02 +0800 Subject: [PATCH] improve sqlwall --- .../com/alibaba/druid/wall/WallProvider.java | 4 +- .../com/alibaba/druid/wall/WallVisitor.java | 4 ++ .../druid/wall/spi/DB2WallVisitor.java | 15 ++++- .../druid/wall/spi/MySqlWallVisitor.java | 15 ++++- .../druid/wall/spi/OracleWallVisitor.java | 15 ++++- .../alibaba/druid/wall/spi/PGWallVisitor.java | 15 ++++- .../druid/wall/spi/SQLServerWallVisitor.java | 15 ++++- .../druid/wall/spi/WallVisitorUtils.java | 15 +++-- .../bvt/filter/wall/MySqlWallTest91.java | 18 +++--- .../bvt/filter/wall/WallDeleteWhereTest2.java | 52 +++++++++++++++++ .../bvt/filter/wall/WallHavingTest6.java | 56 +++++++++++++++++++ .../bvt/filter/wall/WallSelectWhereTest6.java | 56 +++++++++++++++++++ .../bvt/filter/wall/WallUpdateWhereTest1.java | 52 +++++++++++++++++ 13 files changed, 304 insertions(+), 28 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java diff --git a/src/main/java/com/alibaba/druid/wall/WallProvider.java b/src/main/java/com/alibaba/druid/wall/WallProvider.java index 3598817732..c818ec9120 100644 --- a/src/main/java/com/alibaba/druid/wall/WallProvider.java +++ b/src/main/java/com/alibaba/druid/wall/WallProvider.java @@ -645,9 +645,7 @@ public abstract class WallProvider { } WallVisitor visitor = createWallVisitor(); - if (!endOfComment) { - visitor.getConfig().setSelectUnionCheck(false); - } + visitor.setSqlEndOfComment(endOfComment); if (statementList.size() > 0) { boolean lastIsHint = false; diff --git a/src/main/java/com/alibaba/druid/wall/WallVisitor.java b/src/main/java/com/alibaba/druid/wall/WallVisitor.java index 5e2676ebd7..c926e2a01b 100644 --- a/src/main/java/com/alibaba/druid/wall/WallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/WallVisitor.java @@ -39,4 +39,8 @@ public interface WallVisitor extends SQLASTVisitor { void setSqlModified(boolean sqlModified); String getDbType(); + + boolean isSqlEndOfComment(); + + void setSqlEndOfComment(boolean sqlEndOfComment); } diff --git a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java index 7d93da8754..16f2e28fc2 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java @@ -55,8 +55,9 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public DB2WallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -274,4 +275,14 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 2e14f2927f..5a707f001e 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -73,8 +73,9 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public MySqlWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -466,5 +467,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java index 8484d29b45..830ca77ee5 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java @@ -63,8 +63,9 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public OracleWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -347,4 +348,14 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java index 92eb817aae..671293d325 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java @@ -55,8 +55,9 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public PGWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -276,4 +277,14 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index 953d4e22d5..186d4066b7 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -61,8 +61,9 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public SQLServerWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -333,4 +334,14 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 7e8685443c..2e3c5dedb7 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -295,7 +295,8 @@ public class WallVisitorUtils { Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); if (Boolean.TRUE == whereValue) { - if (!isSimpleConstExpr(where)) {// 简单表达式 + if (visitor.getConfig().isSelectWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() + && !isSimpleConstExpr(where)) {// 简单表达式 addViolation(visitor, ErrorCode.ALWAYS_TRUE, "select alway true condition not allow", x); } } @@ -310,7 +311,8 @@ public class WallVisitorUtils { } if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { - if (!isSimpleConstExpr(x)) { + if (visitor.getConfig().isSelectHavingAlwayTrueCheck() && visitor.isSqlEndOfComment() + && !isSimpleConstExpr(x)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x); } } @@ -349,7 +351,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) { - if (!isSimpleConstExpr(where)) { + if (config.isDeleteWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() && !isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x); } } @@ -942,7 +944,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) { - if (!isSimpleConstExpr(where)) { + if (config.isUpdateWhereAlayTrueCheck() && visitor.isSqlEndOfComment()&& !isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x); } } @@ -1388,7 +1390,7 @@ public class WallVisitorUtils { } } - if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { + if (current.hasPartAlwayTrue() && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x); } @@ -2198,7 +2200,8 @@ public class WallVisitorUtils { context.incrementUnionWarnings(); } - if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) && visitor.getConfig().isSelectUnionCheck()) + if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) + && visitor.getConfig().isSelectUnionCheck() && visitor.isSqlEndOfComment()) || (x.getOperator() == SQLUnionOperator.MINUS && visitor.getConfig().isSelectMinusCheck()) || (x.getOperator() == SQLUnionOperator.INTERSECT && visitor.getConfig().isSelectIntersectCheck()) || (x.getOperator() == SQLUnionOperator.EXCEPT && visitor.getConfig().isSelectExceptCheck())) { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java index ff00096522..60d4161022 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -74,7 +74,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false3() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 "; + String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 --ORDER BY SiteID LIMIT 1 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -82,7 +82,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false4() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 "; + String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 --order by sort desc limit 17 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -90,7 +90,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false5() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')"; + String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='') --"; Assert.assertFalse(provider.checkValid(sql)); } } @@ -98,7 +98,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false6() throws Exception { WallProvider provider = initWallProvider(); { - String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 "; + String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') --limit 0,20 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -257,12 +257,12 @@ public class MySqlWallTest91 extends TestCase { Assert.assertTrue(provider.checkValid(sql)); } { - String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'"; - Assert.assertFalse(provider.checkValid(sql)); - } - { - String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true"; + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1' --"; Assert.assertFalse(provider.checkValid(sql)); } +// { +// String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true --"; +// Assert.assertFalse(provider.checkValid(sql)); +// } } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java new file mode 100644 index 0000000000..08a4ea789a --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java @@ -0,0 +1,52 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallDeleteWhereTest2 extends TestCase { + + private String sql = "DELETE FROM T WHERE id = 0 or 1 = 1 --"; + private String sql1 = "DELETE FROM T WHERE id = 0 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setDeleteWhereAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setDeleteWhereAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java new file mode 100644 index 0000000000..52ee172eb1 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java @@ -0,0 +1,56 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallHavingTest6 extends TestCase { + + private String sql = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 --"; + + private String sql1 = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectHavingAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectHavingAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } + + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java new file mode 100644 index 0000000000..68c4aac950 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java @@ -0,0 +1,56 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallSelectWhereTest6 extends TestCase { + + private String sql = "SELECT * FROM T WHERE id = 0 or 1 = 1 --"; + + private String sql1 = "SELECT * FROM T WHERE id = 0 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectWhereAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectWhereAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } + + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java new file mode 100644 index 0000000000..10225c9c51 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java @@ -0,0 +1,52 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallUpdateWhereTest1 extends TestCase { + + private String sql = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 --"; + private String sql1 = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setUpdateWhereAlayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setUpdateWhereAlayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } +}