Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sql wall

Browse Source
This commit is contained in:
wenshao
2013-08-28 16:47:58 +08:00
parent faee5b92b7
commit 670c376feb
9 changed files with 233 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest137.java
+35
View File
@@ -0,0 +1,35 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.MySqlWallProvider;
public class MySqlWallTest137 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
Assert.assertTrue(provider.checkValid("select bi.title from bbt_item_chd_3 bi " //
+ "where bi.title = '具8\\'\\'/200mm迷OK-6295'"
+ " and bi.item_id <> null and bi.nick = '营店'"));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest138.java
+43
View File
@@ -0,0 +1,43 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.MySqlWallProvider;
public class MySqlWallTest138 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
String sql = "INSERT INTO T01_CHECKIN_CUSTOMER" //
+ "(WEB_USER_ID,NAME,COUNTRY,PROVINCE,CITY" //
+ ",POSTCODE,PHONE,FAX,EMAIL,ADDRESS,FIRST_NAME,LAST_NAME,sex) " //
+ "select 2,null,'4225',null,'beijing','','1','','1223@123.com','beijing','booking','test',null "//
+ "from dual " //
+ "where not exists ("//
+ " select EMAIL" //
+ " from T01_CHECKIN_CUSTOMER" //
+ " where WEB_USER_ID=2 and EMAIL='1223@123.com'" //
+ ")";
Assert.assertTrue(provider.checkValid(sql));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest75.java
+5 -3
View File
@@ -33,13 +33,15 @@ public class MySqlWallTest75 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setCommentAllow(true);
Assert.assertFalse(provider.checkValid(//
"UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.',friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705"));
"UPDATE friends_a SET requests='-^B}q^A(X \\0\\0\\0176403924cdatetime\\ndatetime\\nq^BU\\n^G--\\Z^K:5^Hw.-Rq^CX \\0\\0\\0942515122h^BU\\n^G--^X^G^^$\\n^NӅRq^DX \\0\\0\\0760857294h^BU\\n^G-- ^F8+ ---Rq^EX \\0\\0\\0207000491h^BU\\n^G--^X^E^_^L^F-$-Rq^FX \\0\\0\\0281067699h^BU\\n^G--^B^O^C-^A<13>Rq^GX \\0\\0\\0941678014h^BU\\n^G--^\\^W^N^W^F-$-Rq^HX \\0\\0\\0840070155h^BU\\n^G--^\\^L\\n6^D*ʅRq X \\0\\0\\0468440035h^BU\\n^G--^V^W*^N^Bp^K-Rq\\nU 169240315h^BU\\n^G--^W^U^W1^D-m-Rq^KX \\0\\0\\0199411251h^BU\\n^G--^V^W%^^^A---Rq^LU 210660648h^BU\\n^G--^\\^W^Y-^F\\Zd-Rq\\rU 262672217h^BU\\n^G--\\Z^V2:^O^U--Rq^NX \\0\\0\\0952838443h^BU\\n^G--^\\^W!7\\r-{-Rq^OX \\0\\0\\0263642777h^BU\\n^G--^B^U/^D^G-̅Rq^PX \\0\\0\\0286685152h^BU\\n^G--^W^T3,^Ggs-Rq^QU 290976173h^BU\\n^G--^\\^V)^X^D---Rq^RX \\0\\0\\0825427842h^BU\\n^G--\\Z^V;^Q^N- -Rq^SX \\0\\0\\0399352674h^BU\\n^G--^\\^V-0^KC\\0-Rq^TX \\0\\0\\0429293778h^BU\\n^G--^Y^U ^]^C-��Rq^UX \\0\\0\\0796702973h^BU\\n^G--^Y^S^U#^F\\\\^W-Rq^Vu.'"//
+ ",friends='-^B}q^A(X \\0\\0\\0288854421cdatetime\\ndatetime\\nq^BU\\n^G--^[^N38^L6---q^CX \\0\\0\\0307943786h^BU\\n^G--^F^V7 ^D---Rq^DX \\0\\0\\0290783072NX \\0\\0\\0498070760NX \\0\\0\\0457575155NX \\0\\0\\0304215892h^BU\\n^G--^F^W^L+^L---Rq^EX \\0\\0\\0300254457h^BU\\n^G--^F^G$)^A---Rq^FX \\0\\0\\0252042226h^BU\\n^G-- ^R8\\r ----q^GX \\0\\0\\0697110711NX \\0\\0\\0809118053h^BU\\n^G-- ^L^H^O\\0ɲ-Rq^HX \\0\\0\\0293303495h^BU\\n^G-- ^T!.^B/ʅRq X \\0\\0\\0302651538h^BU\\n^G--^G^P)^C^Fn---q\\nU 888879887h^BU\\n^G--^H^W.*^G---Rq^KX \\0\\0\\0240865621h^BU\\n^G--^G\\n2;\\n---Rq^LU 300728616h^BU\\n^G--^A^L^N8\\0\\'" //
+ "--Rq\\rX \\0\\0\\0856456443NX \\0\\0\\0302371154h^BU\\n^G--^A^Q^R^^\\0---Rq^NX \\0\\0\\0696458616h^BU\\n^G--^G\\n98\\n---Rq^OU 297082613NX \\0\\0\\0811281930h^BU\\n^G--\\n^Q^P^X^L^OɅRq^PU 300986758h^BU\\n^G--^F^F\\r3^G-$-Rq^QU 276325435h^BU\\n^G--^B^P^P^T^E^N8-Rq^RX \\0\\0\\0299082034h^BU\\n^G--^H^W^_^Q^D<--Rq^SX \\0\\0\\0171238051h^BU\\n^G--\\n\\r)^S^Dܢ-Rq^TX \\0\\0\\0780724792h^BU\\n^G--\\n^N+ ^F*>-Rq^UX \\0\\0\\0893552392h^BU\\n^G--\\n^N^_-^K^L--Rq^VX \\0\\0\\0590290136h^BU\\n^G-- \\r^Y0\\r --Rq^WX \\0\\0\\0302913387h^BU\\n^G--^C^K#,\\0^X9-Rq^XX \\0\\0\\0252736446NX \\0\\0\\0302360033h^BU\\n^G--^C^O^A^^^H-[-Rq^YU 276564368h^BU\\n^G--\\n\\r:+^K-q-Rq\\ZX \\0\\0\\0296693715h^BU\\n^G-- ^G^[/^A-F-Rq^[X \\0\\0\\0223225019h^BU\\n^G-- ^S^X^C\\07\\Z-Rq^\\X \\0\\0\\0232453764h^BU\\n^G--^_\\r3^V\\0---Rq^]U 297276051h^BU\\n^G--^C^K/4^K-؅Rq^^X \\0\\0\\0184978889NX \\0\\0\\0813351784h^BU\\n^G--^H^H%^X^E&^S-Rq^_X \\0\\0\\03028705"));
Assert.assertEquals(1, provider.getTableStats().size());
Assert.assertEquals(0, provider.getTableStats().size());
}
}
src/test/java/com/alibaba/druid/test/wall/MySqlResourceWallTest.java
+79
View File
@@ -0,0 +1,79 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.test.wall;
import java.io.File;
import java.io.FileInputStream;
import junit.framework.TestCase;
import com.alibaba.druid.util.Utils;
import com.alibaba.druid.wall.Violation;
import com.alibaba.druid.wall.WallCheckResult;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.MySqlWallProvider;
public class MySqlResourceWallTest extends TestCase {
private String[] items;
protected void setUp() throws Exception {
// File file = new File("/home/wenshao/error_sql");
File file = new File("/home/wenshao/scan_result");
FileInputStream is = new FileInputStream(file);
String text = Utils.read(is);
is.close();
items = text.split("\\|\\n\\|");
}
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setConditionDoubleConstAllow(true);
provider.getConfig().setUseAllow(true);
provider.getConfig().setStrictSyntaxCheck(false);
provider.getConfig().setMultiStatementAllow(true);
provider.getConfig().setConditionAndAlwayTrueAllow(true);
provider.getConfig().setNoneBaseStatementAllow(true);
provider.getConfig().setSelectUnionCheck(false);
provider.getConfig().setSchemaCheck(true);
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
for (int i = 0; i < items.length; ++i) {
String sql = items[i];
if (sql.indexOf("''=''") != -1) {
continue;
}
// if (i <= 121) {
// continue;
// }
WallCheckResult result = provider.check(sql);
if (result.getViolations().size() > 0) {
Violation violation = result.getViolations().get(0);
System.out.println("error (" + i + ") : " + violation.getMessage());
System.out.println(sql);
break;
}
}
System.out.println(provider.getViolationCount());
// String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND (CASE WHEN (7885=7885) THEN 1 ELSE 0 END)";
// Assert.assertFalse(provider.checkValid(sql));
}
}