improve sql wall

2023-03-04 19:17:16 +00:00 · 2013-08-28 16:47:58 +08:00
parent faee5b92b7
commit 670c376feb
9 changed files with 233 additions and 53 deletions
@@ -64,19 +64,19 @@ public class MySqlLexer extends Lexer {
        super(input);
        super.keywods = DEFAULT_MYSQL_KEYWORDS;
    }
-    
+
    public void scanSharp() {
        if (ch != '#') {
            throw new ParserException("illegal stat");
        }
-        
+
        if (charAt(pos + 1) == '{') {
            scanVariable();
            return;
        }
-        
+
        Token lastToken = this.token;
-        
+
        scanChar();
        mark = pos;
        bufPos = 0;
@@ -102,10 +102,10 @@ public class MySqlLexer extends Lexer {
            scanChar();
            bufPos++;
        }
-        
+
        stringVal = subString(mark, bufPos);
        token = Token.LINE_COMMENT;
-        
+
        if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) {
            return;
        }
@@ -315,7 +315,7 @@ public class MySqlLexer extends Lexer {

                switch (ch) {
                    case '\0':
-                        putChar('\0');
+                        putChar(ch = '\0');
                        break;
                    case '\'':
                        putChar('\'');
@@ -345,20 +345,19 @@ public class MySqlLexer extends Lexer {
                        putChar(ch);
                        break;
                }
-                scanChar();
-            }
-
-            if (ch == '\'') {
-                scanChar();
-                if (ch != '\'') {
-                    token = LITERAL_CHARS;
-                    break;
-                } else {
-                    initBuff(bufPos);
-                    arraycopy(mark + 1, buf, 0, bufPos);
-                    hasSpecial = true;
-                    putChar('\'');
-                    continue;
+            } else {
+                if (ch == '\'') {
+                    scanChar();
+                    if (ch != '\'') {
+                        token = LITERAL_CHARS;
+                        break;
+                    } else {
+                        initBuff(bufPos);
+                        arraycopy(mark + 1, buf, 0, bufPos);
+                        hasSpecial = true;
+                        putChar('\'');
+                        continue;
+                    }
                }
            }

@@ -438,7 +437,7 @@ public class MySqlLexer extends Lexer {
            if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) {
                return;
            }
-            
+
            if (!isAllowComment()) {
                throw new NotAllowCommentException();
            }
@@ -474,7 +473,7 @@ public class MySqlLexer extends Lexer {

            stringVal = subString(mark, bufPos + 1);
            token = Token.LINE_COMMENT;
-            
+
            if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) {
                return;
            }
@@ -482,7 +481,7 @@ public class MySqlLexer extends Lexer {
            if (!isAllowComment()) {
                throw new NotAllowCommentException();
            }
-            
+
            return;
        }
    }
@@ -1210,7 +1210,7 @@ public class SQLExprParser extends SQLParser {

            if (lexer.token() == Token.ESCAPE) {
                lexer.nextToken();
-                rightExp = expr();
+                rightExp = primary();
                expr = new SQLBinaryOpExpr(expr, SQLBinaryOperator.Escape, rightExp);
            }
        } else if (lexer.token() == (Token.NOT)) {
@@ -570,8 +570,12 @@ public class SQLEvalVisitorUtils {
    public static boolean visit(SQLEvalVisitor visitor, SQLHexExpr x) {
        String hex = x.getHex();
        byte[] bytes = HexBin.decode(hex);
-        String val = new String(bytes);
-        x.putAttribute(EVAL_VALUE, val);
+        if (bytes == null) {
+            x.putAttribute(EVAL_VALUE, EVAL_ERROR);
+        } else {
+            String val = new String(bytes);
+            x.putAttribute(EVAL_VALUE, val);
+        }
        return true;
    }

@@ -807,9 +811,13 @@ public class SQLEvalVisitorUtils {
                x.putAttribute(EVAL_VALUE, val);
                break;
            case NOT:
-            case Not:
-                x.putAttribute(EVAL_VALUE, !castToBoolean(val));
+            case Not: {
+                Boolean booleanVal = castToBoolean(val);
+                if (booleanVal != null) {
+                    x.putAttribute(EVAL_VALUE, !booleanVal);
+                }
                break;
+            }
            case Plus:
                x.putAttribute(EVAL_VALUE, val);
                break;
@@ -1368,9 +1376,9 @@ public class SQLEvalVisitorUtils {
            BigDecimal decimalA = castToDecimal(a);
            BigDecimal decimalB = castToDecimal(b);
            if (decimalB.scale() < decimalA.scale()) {
-                decimalB.setScale(decimalA.scale());
+                decimalB = decimalB.setScale(decimalA.scale());
            }
-            return decimalA.divide(decimalB);
+            return decimalA.divide(decimalB, BigDecimal.ROUND_HALF_UP);
        }

        if (a instanceof Double || b instanceof Double) {
@@ -36,7 +36,9 @@ public class WallConfig implements WallConfigMBean {
    private boolean             createTableAllow           = true;
    private boolean             dropTableAllow             = true;
    private boolean             alterTableAllow            = true;
+
    private boolean             conditionAndAlwayTrueAllow = false;
+    private boolean             conditionDoubleConstAllow  = false;

    private boolean             selectAllColumnAllow       = true;

@@ -110,6 +112,14 @@ public class WallConfig implements WallConfigMBean {

    }

+    public boolean isConditionDoubleConstAllow() {
+        return conditionDoubleConstAllow;
+    }
+
+    public void setConditionDoubleConstAllow(boolean conditionDoubleConstAllow) {
+        this.conditionDoubleConstAllow = conditionDoubleConstAllow;
+    }
+
    public boolean isLimitZeroAllow() {
        return limitZeroAllow;
    }
@@ -164,7 +164,7 @@ public class WallVisitorUtils {

    public static void check(WallVisitor visitor, SQLSelectItem x) {
        SQLExpr expr = x.getExpr();
-        
+
        if (expr instanceof SQLVariantRefExpr) {
            if ("@".equals(((SQLVariantRefExpr) expr).getName())) {
                addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x);
@@ -223,14 +223,16 @@ public class WallVisitorUtils {

            SQLExpr where = x.getWhere();
            if (where != null) {
-                if (queryBlockFromIsNull(visitor, x, false)) {
-                    addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x);
-                }
-
                where.setParent(x);
                checkCondition(visitor, x.getWhere());

-                if (Boolean.TRUE == getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck())) {
+                Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
+
+                if (queryBlockFromIsNull(visitor, x, false) && whereValue != null) {
+                    addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x);
+                }
+
+                if (Boolean.TRUE == whereValue) {
                    boolean isSimpleConstExpr = false;
                    SQLExpr first = getFirst(where);

@@ -672,22 +674,24 @@ public class WallVisitorUtils {
        }

        if (x.getOperator() == SQLBinaryOperator.BooleanAnd) {
-            if (rightResult != null && x.getLeft() instanceof SQLBinaryOpExpr) {
-                SQLBinaryOpExpr leftBinaryOpExpr = (SQLBinaryOpExpr) x.getLeft();
+            if (visitor != null && !visitor.getConfig().isConditionDoubleConstAllow()) {
+                if (rightResult != null && x.getLeft() instanceof SQLBinaryOpExpr) {
+                    SQLBinaryOpExpr leftBinaryOpExpr = (SQLBinaryOpExpr) x.getLeft();

-                if (leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanAnd //
-                    && leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanOr //
-                    && leftResult != null //
-                    && visitor != null) {
-                    addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x);
-                }
-
-                if (leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanAnd //
-                    || leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanOr) {
-                    Object leftRightVal = getValue(leftBinaryOpExpr.getRight());
-                    if (leftRightVal != null) {
+                    if (leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanAnd //
+                        && leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanOr //
+                        && leftResult != null //
+                        && visitor != null) {
                        addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x);
                    }
+
+                    if (leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanAnd //
+                        || leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanOr) {
+                        Object leftRightVal = getValue(leftBinaryOpExpr.getRight());
+                        if (leftRightVal != null) {
+                            addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x);
+                        }
+                    }
                }
            }

@@ -0,0 +1,35 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest137 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        Assert.assertTrue(provider.checkValid("select bi.title from bbt_item_chd_3 bi " //
+                                               + "where bi.title = '具8\\'\\'/200mm迷OK-6295'"
+                                               + "  and bi.item_id <> null and bi.nick = '营店'"));
+    }
+
+}
@@ -0,0 +1,43 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest138 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        String sql = "INSERT INTO T01_CHECKIN_CUSTOMER" //
+                     + "(WEB_USER_ID,NAME,COUNTRY,PROVINCE,CITY" //
+                     + ",POSTCODE,PHONE,FAX,EMAIL,ADDRESS,FIRST_NAME,LAST_NAME,sex) " //
+                     + "select 2,null,'4225',null,'beijing','','1','','1223@123.com','beijing','booking','test',null "//
+                     + "from dual " //
+                     + "where not exists   ("//
+                     + "    select EMAIL" //
+                     + "    from T01_CHECKIN_CUSTOMER" //
+                     + "    where WEB_USER_ID=2 and EMAIL='1223@123.com'" //
+                     + ")";
+        Assert.assertTrue(provider.checkValid(sql));
+    }
+
+}
@@ -33,13 +33,15 @@ public class MySqlWallTest75 extends TestCase {

    public void test_false() throws Exception {
        WallProvider provider = new MySqlWallProvider();
-        
+
        provider.getConfig().setCommentAllow(true);

        Assert.assertFalse(provider.checkValid(//
-        "UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.',friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705"));
+        "UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.'"//
+                + ",friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'" //
+                + "--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705"));

-        Assert.assertEquals(1, provider.getTableStats().size());
+        Assert.assertEquals(0, provider.getTableStats().size());
    }

 }
@@ -0,0 +1,79 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.test.wall;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import junit.framework.TestCase;
+
+import com.alibaba.druid.util.Utils;
+import com.alibaba.druid.wall.Violation;
+import com.alibaba.druid.wall.WallCheckResult;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlResourceWallTest extends TestCase {
+
+    private String[] items;
+
+    protected void setUp() throws Exception {
+//        File file = new File("/home/wenshao/error_sql");
+        File file = new File("/home/wenshao/scan_result");
+        FileInputStream is = new FileInputStream(file);
+        String text = Utils.read(is);
+        is.close();
+        items = text.split("\\|\\n\\|");
+    }
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        
+        provider.getConfig().setConditionDoubleConstAllow(true);
+        
+        provider.getConfig().setUseAllow(true);
+        provider.getConfig().setStrictSyntaxCheck(false);
+        provider.getConfig().setMultiStatementAllow(true);
+        provider.getConfig().setConditionAndAlwayTrueAllow(true);
+        provider.getConfig().setNoneBaseStatementAllow(true);
+        provider.getConfig().setSelectUnionCheck(false);
+        provider.getConfig().setSchemaCheck(true);
+        provider.getConfig().setLimitZeroAllow(true);
+        provider.getConfig().setCommentAllow(true);
+
+        for (int i = 0; i < items.length; ++i) {
+            String sql = items[i];
+            if (sql.indexOf("''=''") != -1) {
+                continue;
+            }
+//            if (i <= 121) {
+//                continue;
+//            }
+            WallCheckResult result = provider.check(sql);
+            if (result.getViolations().size() > 0) {
+                Violation violation = result.getViolations().get(0);
+                System.out.println("error (" + i + ") : " + violation.getMessage());
+                System.out.println(sql);
+                break;
+            }
+        }
+        System.out.println(provider.getViolationCount());
+//        String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND (CASE WHEN (7885=7885) THEN 1 ELSE 0 END)";
+
+//        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}