improve wallfilter

src/main/java/com/alibaba/druid/sql/ast/statement/SQLInsertStatement.java

@@ -54,6 +54,9 @@ public class SQLInsertStatement extends SQLInsertInto implements SQLStatement {
 
         public ValuesClause(List<SQLExpr> values){
             this.values = values;
+            for (int i = 0; i < values.size(); ++i) {
+                values.get(i).setParent(this);
+            }
         }
 
         public List<SQLExpr> getValues() {

src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerStatementParser.java

@@ -100,7 +100,7 @@ public class SQLServerStatementParser extends SQLStatementParser {
             for (;;) {
                 accept(Token.LPAREN);
                 SQLInsertStatement.ValuesClause values = new SQLInsertStatement.ValuesClause();
-                this.exprParser.exprList(values.getValues());
+                this.exprParser.exprList(values.getValues(), values);
                 insertStatement.getValuesList().add(values);
                 accept(Token.RPAREN);
 

src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java

@@ -25,6 +25,7 @@ import com.alibaba.druid.sql.ast.SQLDataType;
 import com.alibaba.druid.sql.ast.SQLDataTypeImpl;
 import com.alibaba.druid.sql.ast.SQLExpr;
 import com.alibaba.druid.sql.ast.SQLName;
+import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.SQLOrderingSpecification;
 import com.alibaba.druid.sql.ast.SQLOver;
@@ -536,7 +537,7 @@ public class SQLExprParser extends SQLParser {
             }
 
             if (lexer.token() != Token.RPAREN) {
-                exprList(methodInvokeExpr.getParameters());
+                exprList(methodInvokeExpr.getParameters(), methodInvokeExpr);
             }
 
             accept(Token.RPAREN);
@@ -611,8 +612,12 @@ public class SQLExprParser extends SQLParser {
             exprCol.add(name());
         }
     }
-
+    
     public final void exprList(Collection<SQLExpr> exprCol) {
+        exprList(exprCol, null);
+    }
+
+    public final void exprList(Collection<SQLExpr> exprCol, SQLObject parent) {
         if (lexer.token() == Token.RPAREN || lexer.token() == Token.RBRACKET) {
             return;
         }
@@ -622,11 +627,13 @@ public class SQLExprParser extends SQLParser {
         }
 
         SQLExpr expr = expr();
+        expr.setParent(parent);
         exprCol.add(expr);
 
         while (lexer.token() == Token.COMMA) {
             lexer.nextToken();
             expr = expr();
+            expr.setParent(parent);
             exprCol.add(expr);
         }
     }

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -204,7 +204,7 @@ public class WallVisitorUtils {
             if (Boolean.TRUE == getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck())) {
                 boolean isSimpleConstExpr = false;
                 SQLExpr first = getFirst(where);
-                
+
                 if (first == where) {
                     isSimpleConstExpr = true;
                 } else if (first instanceof SQLBinaryOpExpr) {
@@ -245,9 +245,9 @@ public class WallVisitorUtils {
                     }
                 }
             }
-            
+
             if (!isSimpleConstExpr) {
-                addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x);                
+                addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x);
             }
         }
     }
@@ -621,15 +621,16 @@ public class WallVisitorUtils {
 
         return SQLEvalVisitorUtils.eval(dbType, x, Collections.emptyList(), false);
     }
-    
+
     public static SQLExpr getFirst(SQLExpr x) {
         if (x instanceof SQLBinaryOpExpr) {
             SQLBinaryOpExpr binary = (SQLBinaryOpExpr) x;
-            if (binary.getOperator() == SQLBinaryOperator.BooleanAnd || binary.getOperator() == SQLBinaryOperator.BooleanOr) {
+            if (binary.getOperator() == SQLBinaryOperator.BooleanAnd
+                || binary.getOperator() == SQLBinaryOperator.BooleanOr) {
                 return getFirst(((SQLBinaryOpExpr) x).getLeft());
             }
         }
-        
+
         return x;
     }
 
@@ -673,6 +674,24 @@ public class WallVisitorUtils {
                     return false;
                 }
             }
+            
+            if (parent instanceof SQLDeleteStatement) {
+                SQLDeleteStatement delete = (SQLDeleteStatement) parent;
+                if (delete.getWhere() == x) {
+                    return true;
+                } else {
+                    return false;
+                }
+            }
+            
+            if (parent instanceof SQLUpdateStatement) {
+                SQLUpdateStatement update = (SQLUpdateStatement) parent;
+                if (update.getWhere() == x) {
+                    return true;
+                } else {
+                    return false;
+                }
+            }
 
             if (parent instanceof SQLSelectGroupByClause) {
                 SQLSelectGroupByClause groupBy = (SQLSelectGroupByClause) parent;
@@ -952,7 +971,9 @@ public class WallVisitorUtils {
                 }
             }
 
-            addViolation(visitor, ErrorCode.FUNCTION_DENY, "deny function : " + methodName, x);
+            if (isWhereOrHaving(x)) {
+                addViolation(visitor, ErrorCode.FUNCTION_DENY, "deny function : " + methodName, x);
+            }
         }
     }