From ad6f6a593c6e72fe6e5252230851acfc69c6517f Mon Sep 17 00:00:00 2001
From: Yako <yako@YakotekiMacBook-Pro.local>
Date: Fri, 22 Aug 2014 14:42:04 +0800
Subject: [PATCH] improve sqlwall

---
 .../alibaba/druid/wall/spi/MySqlWallVisitor.java   | 14 ++++++++++++++
 .../druid/bvt/filter/wall/MySqlWallTest.java       |  2 ++
 2 files changed, 16 insertions(+)

diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
index 5c768cce90..690377a213 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
@@ -482,6 +482,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         if (text.indexOf("or") != -1 //
             || text.indexOf("and") != -1 //
             || text.indexOf("union") != -1 //
+            || text.indexOf("xor") != -1 //
 
             || text.indexOf("select") != -1 //
             || text.indexOf("delete") != -1 //
@@ -501,6 +502,19 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
             || text.indexOf("sleep") != -1 //
             || text.indexOf("benchmark") != -1 //
             || text.indexOf("load_file") != -1 //
+            || text.indexOf("version") != -1 //
+            || text.indexOf("database") != -1 //
+            || text.indexOf("schema") != -1 //
+            || text.indexOf("system_user") != -1 //
+            || text.indexOf("session_user") != -1 //
+            || text.indexOf("current_user") != -1 //
+            || text.indexOf("user") != -1 //
+            || text.indexOf("xmltype") != -1 //
+            || text.indexOf("receive_message") != -1 //
+
+            || text.indexOf("version_compile_os") != -1 //
+            || text.indexOf("basedir") != -1 //
+            || text.indexOf("datadir") != -1 //
         ) {
             addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x)));
         }
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
index ba5849a0d4..e84ba46601 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
@@ -49,5 +49,7 @@ public class MySqlWallTest extends TestCase {
         Assert.assertTrue(WallUtils.isValidateMySql("select c1 from t where 1=1 or id =1"));
         Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 or 1=1"));
         Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 || 1=1"));
+        
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from person where id = '3'/**/union select v,b,a from (select 1,2,4/*! ,database() as b,user() as a,version() as v*/) a where '1'<>''"));
     }
 }