Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve wall filter

Browse Source
This commit is contained in:
wenshao
2013-04-01 23:06:50 +08:00
parent 6ff2bb6a5e
commit 5f689f7aa5
10 changed files with 35 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/ast/expr/SQLIdentifierExpr.java
+15 -2
View File
@@ -25,15 +25,16 @@ public class SQLIdentifierExpr extends SQLExprImpl implements SQLName {
private String name;
private transient String lowerName;
public SQLIdentifierExpr(){
}
public SQLIdentifierExpr(String name){
this.name = name;
}
public String getSimleName() {
return name;
}
@@ -44,6 +45,18 @@ public class SQLIdentifierExpr extends SQLExprImpl implements SQLName {
public void setName(String name) {
this.name = name;
this.lowerName = null;
}
public String getLowerName() {
if (lowerName == null && name != null) {
lowerName = name.toLowerCase();
}
return lowerName;
}
public void setLowerName(String lowerName) {
this.lowerName = lowerName;
}
public void output(StringBuffer buf) {
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+4
View File
@@ -357,6 +357,10 @@ public class MySqlLexer extends Lexer {
}
for (;;) {
if (ch == EOI) {
this.token = Token.ERROR;
return;
}
if (ch == '*' && charAt(pos + 1) == '/') {
bufPos += 2;
scanChar();
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java
+2 -1
View File
@@ -189,7 +189,8 @@ public class MySqlStatementParser extends SQLStatementParser {
}
public SQLSelectStatement parseSelect() {
return new SQLSelectStatement(new MySqlSelectParser(this.exprParser).select());
MySqlSelectParser selectParser = new MySqlSelectParser(this.exprParser);
return new SQLSelectStatement(selectParser.select());
}
public SQLUpdateStatement parseUpdateStatement() {
src/main/java/com/alibaba/druid/wall/WallFilter.java
+2 -10
View File
@@ -21,7 +21,6 @@ import java.sql.Wrapper;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import java.util.concurrent.atomic.AtomicLong;
import com.alibaba.druid.DruidRuntimeException;
import com.alibaba.druid.filter.FilterAdapter;
@@ -56,9 +55,6 @@ public class WallFilter extends FilterAdapter implements WallFilterMBean {
private volatile boolean logViolation = false;
private volatile boolean throwException = true;
// stats
private final AtomicLong violationCount = new AtomicLong();
@Override
public void init(DataSourceProxy dataSource) {
if (this.dbType == null || this.dbType.trim().length() == 0) {
@@ -421,8 +417,6 @@ public class WallFilter extends FilterAdapter implements WallFilterMBean {
List<Violation> violations = checkResult.getViolations();
if (violations.size() > 0) {
violationCount.incrementAndGet();
Violation firstViolation = violations.get(0);
if (isLogViolation()) {
LOG.error("sql injection violation, " + firstViolation.getMessage() + " : " + sql);
@@ -461,7 +455,6 @@ public class WallFilter extends FilterAdapter implements WallFilterMBean {
}
if (!this.provider.getConfig().isWrapAllow()) {
violationCount.incrementAndGet();
return null;
}
@@ -475,7 +468,6 @@ public class WallFilter extends FilterAdapter implements WallFilterMBean {
}
if (!this.provider.getConfig().isMetadataAllow()) {
violationCount.incrementAndGet();
if (isLogViolation()) {
LOG.error("not support method : Connection.getMetdataData");
}
@@ -491,11 +483,11 @@ public class WallFilter extends FilterAdapter implements WallFilterMBean {
}
public long getViolationCount() {
return this.violationCount.get();
return this.provider.getViolationCount();
}
public void resetViolationCount() {
this.violationCount.set(0);
this.provider.reset();
}
public void clearWhiteList() {
src/main/java/com/alibaba/druid/wall/WallProvider.java
+5 -2
View File
@@ -94,7 +94,10 @@ public abstract class WallProvider {
public WallTableStat getTableStat(String tableName) {
String lowerCaseName = tableName.toLowerCase();
return getTableStatWithLowerName(lowerCaseName);
}
public WallTableStat getTableStatWithLowerName(String lowerCaseName) {
WallTableStat stat = tableStats.get(lowerCaseName);
if (stat == null) {
if (tableStats.size() > 10000) {
@@ -385,7 +388,7 @@ public abstract class WallProvider {
for (Map.Entry<String, WallSqlTableStat> entry : sqlStat.getTableStats().entrySet()) {
String tableName = entry.getKey();
WallSqlTableStat sqlTableStat = entry.getValue();
WallTableStat tableStat = getTableStat(tableName);
WallTableStat tableStat = getTableStatWithLowerName(tableName);
if (tableStat != null) {
tableStat.addSqlTableStat(sqlTableStat);
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_delete.java
+1 -1
View File
@@ -14,7 +14,7 @@ import com.alibaba.druid.wall.spi.SQLServerWallProvider;
public class WallStatTest_delete extends TestCase {
private String sql = "delete from t where fid = ?";
private String sql = "delete from T where fid = ?";
protected void setUp() throws Exception {
WallContext.clearContext();
src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest3.java
+2 -2
View File
@@ -29,8 +29,8 @@ import com.alibaba.druid.wall.WallUtils;
public class WallUnionTest3 extends TestCase {
public void testMySql() throws Exception {
Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'"));
Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x';"));
// Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'"));
// Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x';"));
Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;"));
}
}
src/test/java/com/alibaba/druid/bvt/pool/SpringIbatisFilterTest.java
+1 -1
View File
@@ -23,9 +23,9 @@ import java.util.concurrent.atomic.AtomicLong;
import javax.sql.DataSource;
import junit.framework.Assert;
import junit.framework.TestCase;
import org.junit.Assert;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import com.alibaba.druid.filter.FilterAdapter;
src/test/java/com/alibaba/druid/bvt/pool/SpringMybatisFilterTest.java
+1 -1
View File
@@ -20,11 +20,11 @@ import java.sql.Statement;
import javax.sql.DataSource;
import junit.framework.Assert;
import junit.framework.TestCase;
import org.apache.ibatis.annotations.Insert;
import org.apache.ibatis.annotations.Param;
import org.junit.Assert;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import com.alibaba.druid.spring.User;
src/test/resources/com/alibaba/druid/pool/dataSource.xml
+2 -1
View File
@@ -15,7 +15,8 @@ http://www.springframework.org/schema/aop http://www.springframework.org/schema/
<bean id="wall-filter-config" class="com.alibaba.druid.wall.WallConfig"
init-method="init">
<property name="dir" value="META-INF/druid/wall/mysql" />
<property name="noneBaseStatementAllow" value="true" />
<property name="createTableAllow" value="true" />
<property name="dropTableAllow" value="true" />
</bean>
<bean id="wall-filter" class="com.alibaba.druid.wall.WallFilter">