Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sqlwall

Browse Source
This commit is contained in:
Yako
2014-11-13 16:26:02 +08:00
parent aec444ea17
commit 5edabcbb81
13 changed files with 304 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+9 -9
View File
@@ -74,7 +74,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false3() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 ";
String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 --ORDER BY SiteID LIMIT 1 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -82,7 +82,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false4() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 ";
String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 --order by sort desc limit 17 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -90,7 +90,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false5() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')";
String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='') --";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -98,7 +98,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false6() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 ";
String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') --limit 0,20 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -257,12 +257,12 @@ public class MySqlWallTest91 extends TestCase {
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'";
Assert.assertFalse(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true";
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1' --";
Assert.assertFalse(provider.checkValid(sql));
}
// {
// String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true --";
// Assert.assertFalse(provider.checkValid(sql));
// }
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java
+52
View File
@@ -0,0 +1,52 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallDeleteWhereTest2 extends TestCase {
private String sql = "DELETE FROM T WHERE id = 0 or 1 = 1 --";
private String sql1 = "DELETE FROM T WHERE id = 0 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java
+56
View File
@@ -0,0 +1,56 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallHavingTest6 extends TestCase {
private String sql = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 --";
private String sql1 = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setSelectHavingAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setSelectHavingAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java
+56
View File
@@ -0,0 +1,56 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallSelectWhereTest6 extends TestCase {
private String sql = "SELECT * FROM T WHERE id = 0 or 1 = 1 --";
private String sql1 = "SELECT * FROM T WHERE id = 0 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setSelectWhereAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setSelectWhereAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java
+52
View File
@@ -0,0 +1,52 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallUpdateWhereTest1 extends TestCase {
private String sql = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 --";
private String sql1 = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereAlayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereAlayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}