Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #619 from yakolee/master

Browse Source 
improve sqlwall
This commit is contained in:
Yako
2014-08-22 14:43:02 +08:00
parent 3c572f5f59 ad6f6a593c
commit 695bf56513
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+14
View File
@@ -482,6 +482,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
if (text.indexOf("or") != -1 //
|| text.indexOf("and") != -1 //
|| text.indexOf("union") != -1 //
|| text.indexOf("xor") != -1 //
|| text.indexOf("select") != -1 //
|| text.indexOf("delete") != -1 //
@@ -501,6 +502,19 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
|| text.indexOf("sleep") != -1 //
|| text.indexOf("benchmark") != -1 //
|| text.indexOf("load_file") != -1 //
|| text.indexOf("version") != -1 //
|| text.indexOf("database") != -1 //
|| text.indexOf("schema") != -1 //
|| text.indexOf("system_user") != -1 //
|| text.indexOf("session_user") != -1 //
|| text.indexOf("current_user") != -1 //
|| text.indexOf("user") != -1 //
|| text.indexOf("xmltype") != -1 //
|| text.indexOf("receive_message") != -1 //
|| text.indexOf("version_compile_os") != -1 //
|| text.indexOf("basedir") != -1 //
|| text.indexOf("datadir") != -1 //
) {
addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x)));
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
+2
View File
@@ -49,5 +49,7 @@ public class MySqlWallTest extends TestCase {
Assert.assertTrue(WallUtils.isValidateMySql("select c1 from t where 1=1 or id =1"));
Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 or 1=1"));
Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 || 1=1"));
Assert.assertFalse(WallUtils.isValidateMySql("select * from person where id = '3'/**/union select v,b,a from (select 1,2,4/*! ,database() as b,user() as a,version() as v*/) a where '1'<>''"));
}
}