refactor

src/main/java/com/alibaba/druid/mapping/MappingEngine.java

@@ -9,7 +9,6 @@ import java.util.Map;
 
 import javax.sql.DataSource;
 
-import com.alibaba.druid.mapping.spi.ExportParameterVisitor;
 import com.alibaba.druid.mapping.spi.MappingProvider;
 import com.alibaba.druid.mapping.spi.MappingVisitor;
 import com.alibaba.druid.mapping.spi.MySqlMappingProvider;
@@ -18,6 +17,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 import com.alibaba.druid.util.JdbcUtils;
 

src/main/java/com/alibaba/druid/mapping/spi/ExportParameterVisitor.java

@@ -1,8 +0,0 @@
-package com.alibaba.druid.mapping.spi;
-
-import com.alibaba.druid.sql.visitor.SQLASTVisitor;
-
-
-public interface ExportParameterVisitor extends SQLASTVisitor {
-    
-}

src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerMappingProvider.java

@@ -14,7 +14,9 @@ import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.sqlserver.ast.Top;
 import com.alibaba.druid.sql.dialect.sqlserver.parser.SQLServerSelectParser;
 import com.alibaba.druid.sql.dialect.sqlserver.parser.SQLServerStatementParser;
+import com.alibaba.druid.sql.dialect.sqlserver.visitor.MSSQLServerExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class MSSQLServerMappingProvider implements MappingProvider {

src/main/java/com/alibaba/druid/mapping/spi/MappingProvider.java

@@ -7,6 +7,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public interface MappingProvider {

src/main/java/com/alibaba/druid/mapping/spi/MySqlMappingProvider.java

@@ -13,7 +13,9 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
 import com.alibaba.druid.sql.dialect.mysql.parser.MySqlSelectParser;
 import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class MySqlMappingProvider implements MappingProvider {

src/main/java/com/alibaba/druid/mapping/spi/OracleMappingProvider.java

@@ -10,7 +10,9 @@ import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.oracle.parser.OracleSelectParser;
 import com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser;
+import com.alibaba.druid.sql.dialect.oracle.visitor.OracleExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.oracle.visitor.OracleOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class OracleMappingProvider implements MappingProvider {

src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlExportParameterVisitor.java

@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.mysql.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -10,7 +11,7 @@ import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
-import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class MySqlExportParameterVisitor extends MySqlASTVisitorAdapter implements ExportParameterVisitor {
 

src/main/java/com/alibaba/druid/sql/dialect/oracle/visitor/OracleExportParameterVisitor.java

@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.oracle.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -9,7 +10,7 @@ import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
-import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVIsitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class OracleExportParameterVisitor extends OracleASTVIsitorAdapter implements ExportParameterVisitor {
 

src/main/java/com/alibaba/druid/sql/dialect/sqlserver/visitor/MSSQLServerExportParameterVisitor.java

@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.sqlserver.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -9,7 +10,7 @@ import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
-import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class MSSQLServerExportParameterVisitor extends SQLServerASTVisitorAdapter implements ExportParameterVisitor {
 

src/main/java/com/alibaba/druid/sql/visitor/ExportParameterVisitor.java

@@ -0,0 +1,6 @@
+package com.alibaba.druid.sql.visitor;
+
+
+public interface ExportParameterVisitor extends SQLASTVisitor {
+
+}

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -8,6 +8,7 @@ import com.alibaba.druid.sql.ast.SQLName;
 import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
@@ -55,6 +56,11 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);

src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java

@@ -9,6 +9,7 @@ import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
 import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
@@ -64,6 +65,11 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);

src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java

@@ -9,6 +9,7 @@ import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
 import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr;
@@ -81,8 +82,12 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
-    // executeQuery
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);
         return true;

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -19,6 +19,7 @@ import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator;
 import com.alibaba.druid.sql.ast.expr.SQLCharExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIntegerExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLNCharExpr;
@@ -48,16 +49,27 @@ public class WallVisitorUtils {
 
     private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class);
 
+    public static void check(WallVisitor visitor, SQLInListExpr x) {
+        if (visitor.getConfig().isMustParameterized()) {
+            for (SQLExpr param : x.getTargetList()) {
+                if (getValue(param) != null) {
+                    visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
+                    break;
+                }
+            }
+        }
+    }
+
     public static void check(WallVisitor visitor, SQLBinaryOpExpr x) {
-        if (x.getOperator().isRelational()) {
+        if (x.getOperator().isRelational() && visitor.getConfig().isMustParameterized()) {
             if (x.getLeft() instanceof SQLName && getValue(x.getRight()) != null) {
-                visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));    
+                visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
             } else if (x.getRight() instanceof SQLName && getValue(x.getLeft()) != null) {
                 visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
             }
         }
     }
-    
+
     public static void check(WallVisitor visitor, SQLPropertyExpr x) {
         checkSchema(visitor, x.getOwner());
     }
@@ -321,17 +333,16 @@ public class WallVisitorUtils {
         if (x.getOperator() == SQLBinaryOperator.Concat) {
             return leftResult.toString() + rightResult.toString();
         }
-        
+
         if (x.getOperator() == SQLBinaryOperator.Add) {
             if (leftResult == null || rightResult == null) {
                 return null;
             }
-            
+
             if (leftResult instanceof String || rightResult instanceof String) {
                 return leftResult.toString() + rightResult.toString();
             }
-            
-            
+
             if (leftResult instanceof Number || rightResult instanceof Number) {
                 return add((Number) leftResult, (Number) rightResult);
             }
@@ -339,12 +350,12 @@ public class WallVisitorUtils {
 
         return null;
     }
-    
+
     private static Number add(Number a, Number b) {
         if (a instanceof BigDecimal) {
             return ((BigDecimal) a).add(new BigDecimal(b.toString()));
         }
-        
+
         return a.longValue() + b.longValue();
     }
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest2.java

@@ -0,0 +1,28 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallUtils;
+
+public class MustParameterizedTest2 extends TestCase {
+
+    private String     sql    = "select * from t where id in (3, 5)";
+
+    private WallConfig config = new WallConfig();
+
+    protected void setUp() throws Exception {
+        config.setMustParameterized(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+
+    public void testORACLE() throws Exception {
+
+        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest3.java

@@ -0,0 +1,28 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallUtils;
+
+public class MustParameterizedTest3 extends TestCase {
+
+    private String     sql    = "select * from t where id not in (3, 5)";
+
+    private WallConfig config = new WallConfig();
+
+    protected void setUp() throws Exception {
+        config.setMustParameterized(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+
+    public void testORACLE() throws Exception {
+
+        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+    }
+}