From 6574a0d8cc01838e7e579d4e5c7474f7afb2712d Mon Sep 17 00:00:00 2001 From: wenshao Date: Mon, 18 Mar 2013 19:07:47 +0800 Subject: [PATCH] improve WallFilter --- .../com/alibaba/druid/wall/WallConfig.java | 70 +++++++++---------- .../druid/wall/spi/WallVisitorUtils.java | 7 ++ .../druid/bvt/filter/wall/MySqlWallTest8.java | 52 ++++++++++++++ .../bvt/filter/wall/WallSelectWhereTest2.java | 4 +- .../bvt/filter/wall/WallSelectWhereTest3.java | 5 +- 5 files changed, 98 insertions(+), 40 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest8.java diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 630bed9b3a..2f3809bf29 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -24,62 +24,62 @@ import com.alibaba.druid.wall.spi.WallVisitorUtils; public class WallConfig implements WallConfigMBean { - private boolean noneBaseStatementAllow = false; + private boolean noneBaseStatementAllow = false; - private boolean callAllow = true; - private boolean selelctAllow = true; - private boolean selectIntoAllow = true; - private boolean selectIntoOutfileAllow = false; - private boolean selectWhereAlwayTrueCheck = true; - private boolean selectHavingAlwayTrueCheck = true; - private boolean selectUnionCheck = true; + private boolean callAllow = true; + private boolean selelctAllow = true; + private boolean selectIntoAllow = true; + private boolean selectIntoOutfileAllow = false; + private boolean selectWhereAlwayTrueCheck = true; + private boolean selectHavingAlwayTrueCheck = true; + private boolean selectUnionCheck = true; - private boolean selectAllColumnAllow = true; + private boolean selectAllColumnAllow = true; - private boolean deleteAllow = true; - private boolean deleteWhereAlwayTrueCheck = true; + private boolean deleteAllow = true; + private boolean deleteWhereAlwayTrueCheck = true; - private boolean updateAllow = true; - private boolean updateWhereAlayTrueCheck = true; + private boolean updateAllow = true; + private boolean updateWhereAlayTrueCheck = true; - private boolean insertAllow = true; - private boolean mergeAllow = true; + private boolean insertAllow = true; + private boolean mergeAllow = true; - private boolean multiStatementAllow = false; + private boolean multiStatementAllow = false; - private boolean truncateAllow = false; + private boolean truncateAllow = false; - private boolean commentAllow = false; + private boolean commentAllow = false; - private boolean describeAllow = false; + private boolean describeAllow = false; - private boolean schemaCheck = true; - private boolean tableCheck = true; - private boolean functionCheck = true; - private boolean objectCheck = true; - private boolean variantCheck = true; + private boolean schemaCheck = true; + private boolean tableCheck = true; + private boolean functionCheck = true; + private boolean objectCheck = true; + private boolean variantCheck = true; - private boolean mustParameterized = false; + private boolean mustParameterized = false; - private boolean doPrivilegedAllow = false; + private boolean doPrivilegedAllow = false; protected final Set denyFunctions = new ConcurrentSkipListSet(); protected final Set denyTables = new ConcurrentSkipListSet(); protected final Set denySchemas = new ConcurrentSkipListSet(); - protected final Set denyVariants = new ConcurrentSkipListSet(); - protected final Set denyObjects = new ConcurrentSkipListSet(); + protected final Set denyVariants = new ConcurrentSkipListSet(); + protected final Set denyObjects = new ConcurrentSkipListSet(); - protected final Set readOnlyTables = new ConcurrentSkipListSet(); + protected final Set readOnlyTables = new ConcurrentSkipListSet(); - private String dir; + private String dir; - private boolean inited; + private boolean inited; - private String tenantTablePattern; - private String tenantColumn; + private String tenantTablePattern; + private String tenantColumn; - private boolean wrapAllow = true; - private boolean metadataAllow = true; + private boolean wrapAllow = true; + private boolean metadataAllow = true; public WallConfig(){ diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 18fd9a6764..386ad2cdbb 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -458,6 +458,13 @@ public class WallVisitorUtils { if (Boolean.FALSE == leftResult || Boolean.FALSE == rightResult) { return false; } + + if (leftResult == Boolean.TRUE || rightResult == Boolean.TRUE) { + final WallConditionContext current = wallConditionContextLocal.get(); + if (current != null) { + current.setPartAllowTrue(true); + } + } if (Boolean.TRUE == leftResult && Boolean.TRUE == rightResult) { return true; diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest8.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest8.java new file mode 100644 index 0000000000..b288715bf2 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest8.java @@ -0,0 +1,52 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallUtils; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest8 extends TestCase { + + public void test_false() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "SELECT a.* FROM vote_info a where 1=1 AND FID = ?")); // 前置永真 + } + + public void test_false_1() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "SELECT a.* FROM vote_info a where FID = ? AND 1=1")); // 后置永真，拦截 + } + + public void test_false_2() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "SELECT a.* FROM vote_info a where FID = ? OR (FID = ? AND 1=1)")); // 后置永真，拦截 + } + + public void test_false_3() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "SELECT a.* FROM vote_info a where FID = ? OR (1=1 AND FID = ?)")); // 后置永真，拦截 + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java index 0948e63cbe..084c0a82ef 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java @@ -30,10 +30,10 @@ public class WallSelectWhereTest2 extends TestCase { private String sql = "SELECT F1, F2 WHERE 1 = 1 AND FID = ?"; public void testMySql() throws Exception { - Assert.assertTrue(WallUtils.isValidateMySql(sql)); + Assert.assertFalse(WallUtils.isValidateMySql(sql)); } public void testORACLE() throws Exception { - Assert.assertTrue(WallUtils.isValidateOracle(sql)); + Assert.assertFalse(WallUtils.isValidateOracle(sql)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest3.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest3.java index 1ba0404c0c..3e333b223c 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest3.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest3.java @@ -22,7 +22,6 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; /** - * 这个场景，检测可疑的Having条件 * @author wenshao * */ @@ -30,10 +29,10 @@ public class WallSelectWhereTest3 extends TestCase { private String sql = "select * from t WHERE FID = 256 AND CHR(67)||CHR(65)||CHR(84) = 'CAT'"; public void testMySql() throws Exception { - Assert.assertTrue(WallUtils.isValidateMySql(sql)); + Assert.assertFalse(WallUtils.isValidateMySql(sql)); } public void testORACLE() throws Exception { - Assert.assertTrue(WallUtils.isValidateOracle(sql)); + Assert.assertFalse(WallUtils.isValidateOracle(sql)); } }