diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java index d481bc9ae3..c3e35fc519 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java @@ -64,19 +64,19 @@ public class MySqlLexer extends Lexer { super(input); super.keywods = DEFAULT_MYSQL_KEYWORDS; } - + public void scanSharp() { if (ch != '#') { throw new ParserException("illegal stat"); } - + if (charAt(pos + 1) == '{') { scanVariable(); return; } - + Token lastToken = this.token; - + scanChar(); mark = pos; bufPos = 0; @@ -102,10 +102,10 @@ public class MySqlLexer extends Lexer { scanChar(); bufPos++; } - + stringVal = subString(mark, bufPos); token = Token.LINE_COMMENT; - + if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) { return; } @@ -315,7 +315,7 @@ public class MySqlLexer extends Lexer { switch (ch) { case '\0': - putChar('\0'); + putChar(ch = '\0'); break; case '\'': putChar('\''); @@ -345,20 +345,19 @@ public class MySqlLexer extends Lexer { putChar(ch); break; } - scanChar(); - } - - if (ch == '\'') { - scanChar(); - if (ch != '\'') { - token = LITERAL_CHARS; - break; - } else { - initBuff(bufPos); - arraycopy(mark + 1, buf, 0, bufPos); - hasSpecial = true; - putChar('\''); - continue; + } else { + if (ch == '\'') { + scanChar(); + if (ch != '\'') { + token = LITERAL_CHARS; + break; + } else { + initBuff(bufPos); + arraycopy(mark + 1, buf, 0, bufPos); + hasSpecial = true; + putChar('\''); + continue; + } } } @@ -438,7 +437,7 @@ public class MySqlLexer extends Lexer { if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) { return; } - + if (!isAllowComment()) { throw new NotAllowCommentException(); } @@ -474,7 +473,7 @@ public class MySqlLexer extends Lexer { stringVal = subString(mark, bufPos + 1); token = Token.LINE_COMMENT; - + if (commentHandler != null && commentHandler.handle(lastToken, stringVal)) { return; } @@ -482,7 +481,7 @@ public class MySqlLexer extends Lexer { if (!isAllowComment()) { throw new NotAllowCommentException(); } - + return; } } diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java index 56ac42f7df..78fb8bc140 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java @@ -1210,7 +1210,7 @@ public class SQLExprParser extends SQLParser { if (lexer.token() == Token.ESCAPE) { lexer.nextToken(); - rightExp = expr(); + rightExp = primary(); expr = new SQLBinaryOpExpr(expr, SQLBinaryOperator.Escape, rightExp); } } else if (lexer.token() == (Token.NOT)) { diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index a75344adfc..3ae7ff0da6 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -570,8 +570,12 @@ public class SQLEvalVisitorUtils { public static boolean visit(SQLEvalVisitor visitor, SQLHexExpr x) { String hex = x.getHex(); byte[] bytes = HexBin.decode(hex); - String val = new String(bytes); - x.putAttribute(EVAL_VALUE, val); + if (bytes == null) { + x.putAttribute(EVAL_VALUE, EVAL_ERROR); + } else { + String val = new String(bytes); + x.putAttribute(EVAL_VALUE, val); + } return true; } @@ -807,9 +811,13 @@ public class SQLEvalVisitorUtils { x.putAttribute(EVAL_VALUE, val); break; case NOT: - case Not: - x.putAttribute(EVAL_VALUE, !castToBoolean(val)); + case Not: { + Boolean booleanVal = castToBoolean(val); + if (booleanVal != null) { + x.putAttribute(EVAL_VALUE, !booleanVal); + } break; + } case Plus: x.putAttribute(EVAL_VALUE, val); break; @@ -1368,9 +1376,9 @@ public class SQLEvalVisitorUtils { BigDecimal decimalA = castToDecimal(a); BigDecimal decimalB = castToDecimal(b); if (decimalB.scale() < decimalA.scale()) { - decimalB.setScale(decimalA.scale()); + decimalB = decimalB.setScale(decimalA.scale()); } - return decimalA.divide(decimalB); + return decimalA.divide(decimalB, BigDecimal.ROUND_HALF_UP); } if (a instanceof Double || b instanceof Double) { diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 7996d730d6..e417b7d0fd 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -36,7 +36,9 @@ public class WallConfig implements WallConfigMBean { private boolean createTableAllow = true; private boolean dropTableAllow = true; private boolean alterTableAllow = true; + private boolean conditionAndAlwayTrueAllow = false; + private boolean conditionDoubleConstAllow = false; private boolean selectAllColumnAllow = true; @@ -110,6 +112,14 @@ public class WallConfig implements WallConfigMBean { } + public boolean isConditionDoubleConstAllow() { + return conditionDoubleConstAllow; + } + + public void setConditionDoubleConstAllow(boolean conditionDoubleConstAllow) { + this.conditionDoubleConstAllow = conditionDoubleConstAllow; + } + public boolean isLimitZeroAllow() { return limitZeroAllow; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 865dff8342..46e7f4965b 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -164,7 +164,7 @@ public class WallVisitorUtils { public static void check(WallVisitor visitor, SQLSelectItem x) { SQLExpr expr = x.getExpr(); - + if (expr instanceof SQLVariantRefExpr) { if ("@".equals(((SQLVariantRefExpr) expr).getName())) { addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x); @@ -223,14 +223,16 @@ public class WallVisitorUtils { SQLExpr where = x.getWhere(); if (where != null) { - if (queryBlockFromIsNull(visitor, x, false)) { - addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x); - } - where.setParent(x); checkCondition(visitor, x.getWhere()); - if (Boolean.TRUE == getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck())) { + Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); + + if (queryBlockFromIsNull(visitor, x, false) && whereValue != null) { + addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x); + } + + if (Boolean.TRUE == whereValue) { boolean isSimpleConstExpr = false; SQLExpr first = getFirst(where); @@ -672,22 +674,24 @@ public class WallVisitorUtils { } if (x.getOperator() == SQLBinaryOperator.BooleanAnd) { - if (rightResult != null && x.getLeft() instanceof SQLBinaryOpExpr) { - SQLBinaryOpExpr leftBinaryOpExpr = (SQLBinaryOpExpr) x.getLeft(); + if (visitor != null && !visitor.getConfig().isConditionDoubleConstAllow()) { + if (rightResult != null && x.getLeft() instanceof SQLBinaryOpExpr) { + SQLBinaryOpExpr leftBinaryOpExpr = (SQLBinaryOpExpr) x.getLeft(); - if (leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanAnd // - && leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanOr // - && leftResult != null // - && visitor != null) { - addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x); - } - - if (leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanAnd // - || leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanOr) { - Object leftRightVal = getValue(leftBinaryOpExpr.getRight()); - if (leftRightVal != null) { + if (leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanAnd // + && leftBinaryOpExpr.getOperator() != SQLBinaryOperator.BooleanOr // + && leftResult != null // + && visitor != null) { addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x); } + + if (leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanAnd // + || leftBinaryOpExpr.getOperator() == SQLBinaryOperator.BooleanOr) { + Object leftRightVal = getValue(leftBinaryOpExpr.getRight()); + if (leftRightVal != null) { + addViolation(visitor, ErrorCode.DOUBLE_CONST_CONDITION, "double const condition", x); + } + } } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest137.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest137.java new file mode 100644 index 0000000000..1735ee3390 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest137.java @@ -0,0 +1,35 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest137 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertTrue(provider.checkValid("select bi.title from bbt_item_chd_3 bi " // + + "where bi.title = '具8\\'\\'/200mm迷OK-6295'" + + " and bi.item_id <> null and bi.nick = '营店'")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest138.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest138.java new file mode 100644 index 0000000000..dd9cce22e4 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest138.java @@ -0,0 +1,43 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest138 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + String sql = "INSERT INTO T01_CHECKIN_CUSTOMER" // + + "(WEB_USER_ID,NAME,COUNTRY,PROVINCE,CITY" // + + ",POSTCODE,PHONE,FAX,EMAIL,ADDRESS,FIRST_NAME,LAST_NAME,sex) " // + + "select 2,null,'4225',null,'beijing','','1','','1223@123.com','beijing','booking','test',null "// + + "from dual " // + + "where not exists ("// + + " select EMAIL" // + + " from T01_CHECKIN_CUSTOMER" // + + " where WEB_USER_ID=2 and EMAIL='1223@123.com'" // + + ")"; + Assert.assertTrue(provider.checkValid(sql)); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest75.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest75.java index b2cec6a48c..2e48a82279 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest75.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest75.java @@ -33,13 +33,15 @@ public class MySqlWallTest75 extends TestCase { public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); - + provider.getConfig().setCommentAllow(true); Assert.assertFalse(provider.checkValid(// - "UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.',friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705")); + "UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.'"// + + ",friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'" // + + "--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705")); - Assert.assertEquals(1, provider.getTableStats().size()); + Assert.assertEquals(0, provider.getTableStats().size()); } } diff --git a/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java b/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java new file mode 100644 index 0000000000..881354509f --- /dev/null +++ b/src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java @@ -0,0 +1,79 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.test.wall; + +import java.io.File; +import java.io.FileInputStream; + +import junit.framework.TestCase; + +import com.alibaba.druid.util.Utils; +import com.alibaba.druid.wall.Violation; +import com.alibaba.druid.wall.WallCheckResult; +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlResourceWallTest extends TestCase { + + private String[] items; + + protected void setUp() throws Exception { +// File file = new File("/home/wenshao/error_sql"); + File file = new File("/home/wenshao/scan_result"); + FileInputStream is = new FileInputStream(file); + String text = Utils.read(is); + is.close(); + items = text.split("\\|\\n\\|"); + } + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + provider.getConfig().setConditionDoubleConstAllow(true); + + provider.getConfig().setUseAllow(true); + provider.getConfig().setStrictSyntaxCheck(false); + provider.getConfig().setMultiStatementAllow(true); + provider.getConfig().setConditionAndAlwayTrueAllow(true); + provider.getConfig().setNoneBaseStatementAllow(true); + provider.getConfig().setSelectUnionCheck(false); + provider.getConfig().setSchemaCheck(true); + provider.getConfig().setLimitZeroAllow(true); + provider.getConfig().setCommentAllow(true); + + for (int i = 0; i < items.length; ++i) { + String sql = items[i]; + if (sql.indexOf("''=''") != -1) { + continue; + } +// if (i <= 121) { +// continue; +// } + WallCheckResult result = provider.check(sql); + if (result.getViolations().size() > 0) { + Violation violation = result.getViolations().get(0); + System.out.println("error (" + i + ") : " + violation.getMessage()); + System.out.println(sql); + break; + } + } + System.out.println(provider.getViolationCount()); +// String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND (CASE WHEN (7885=7885) THEN 1 ELSE 0 END)"; + +// Assert.assertFalse(provider.checkValid(sql)); + } + +}