improve wall filter

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest34.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallUtils;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest34 extends TestCase {
+
+    public void test_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(//
+        "SELECT @@sql_big_selects")); //
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallUtils;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest_var extends TestCase {
+
+    public void test_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(//
+        "SELECT @@GLOBAL.sql_mode")); //
+    }
+
+    public void test_true_1() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(//
+        "SELECT @@SESSION.sql_mode;")); //
+    }
+
+    public void test_false() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(//
+        "SELECT * FROM T WHERE @@SESSION.sql_mode = 'ANSI'")); //
+    }
+
+    public void test_false_1() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(//
+        "SELECT * FROM T WHERE @@sql_mode = 'ANSI'")); //
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_var_autoincrement.java

@@ -19,7 +19,6 @@ import junit.framework.TestCase;
 
 import org.junit.Assert;
 
-import com.alibaba.druid.wall.WallConfig;
 import com.alibaba.druid.wall.WallUtils;
 
 /**
@@ -31,10 +30,8 @@ import com.alibaba.druid.wall.WallUtils;
  */
 public class MySqlWallTest_var_autoincrement extends TestCase {
 
-
     public void test_true() throws Exception {
-        WallConfig config = new WallConfig();
         Assert.assertTrue(WallUtils.isValidateMySql(//
-        "/* mysql-connector-java-5.? ( Revision: bzr.revision-id ) */SELECT @@session.auto_increment_increment", config)); //
+        "/* mysql-connector-java-5.? ( Revision: bzr.revision-id ) */SELECT @@session.auto_increment_increment")); //
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest.java

@@ -19,20 +19,33 @@ import junit.framework.TestCase;
 
 import org.junit.Assert;
 
+import com.alibaba.druid.wall.WallConfig;
 import com.alibaba.druid.wall.WallUtils;
 
 /**
  * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * 
  * @author wenshao
- *
  */
 public class WallDropTest extends TestCase {
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("DROP TABLE T1"));
+        WallConfig config = new WallConfig();
+        config.setDropTableAllow(false);
+        Assert.assertFalse(WallUtils.isValidateMySql("DROP TABLE T1", config));
     }
-    
+
     public void testOracle() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("DROP TABLE T1"));
+        WallConfig config = new WallConfig();
+        config.setDropTableAllow(false);
+        Assert.assertFalse(WallUtils.isValidateOracle("DROP TABLE T1", config));
+    }
+
+    public void testMySql_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql("DROP TABLE T1"));
+    }
+
+    public void testOracle_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateOracle("DROP TABLE T1"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_blackList_syntaxError.java

@@ -0,0 +1,53 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallContext;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.WallTableStat;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class WallStatTest_blackList_syntaxError extends TestCase {
+
+    protected void setUp() throws Exception {
+        WallContext.clearContext();
+    }
+
+    protected void tearDown() throws Exception {
+        WallContext.clearContext();
+    }
+
+    public void testMySql() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        String sql = "select xx * x *";
+        Assert.assertFalse(provider.checkValid(sql));
+        {
+            WallTableStat tableStat = provider.getTableStat("t");
+            Assert.assertEquals(0, tableStat.getSelectCount());
+            Assert.assertEquals(0, provider.getBlackListHitCount());
+            Assert.assertEquals(0, provider.getWhiteListHitCount());
+            Assert.assertEquals(0, provider.getWhiteList().size());
+            Assert.assertEquals(1, provider.getBlackList().size());
+            Assert.assertEquals(1, provider.getCheckCount());
+            Assert.assertEquals(1, provider.getSyntaxErrorCount());
+            Assert.assertEquals(1, provider.getHardCheckCount());
+        }
+        
+        Assert.assertFalse(provider.checkValid(sql));
+        {
+            WallTableStat tableStat = provider.getTableStat("t");
+            Assert.assertEquals(0, tableStat.getSelectCount());
+            Assert.assertEquals(1, provider.getBlackListHitCount());
+            Assert.assertEquals(0, provider.getWhiteListHitCount());
+            Assert.assertEquals(0, provider.getWhiteList().size());
+            Assert.assertEquals(1, provider.getBlackList().size());
+            Assert.assertEquals(2, provider.getCheckCount());
+            Assert.assertEquals(2, provider.getSyntaxErrorCount());
+            Assert.assertEquals(1, provider.getHardCheckCount());
+        }
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_whiteList_syntaxError.java

@@ -0,0 +1,54 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallContext;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.WallTableStat;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class WallStatTest_whiteList_syntaxError extends TestCase {
+
+    protected void setUp() throws Exception {
+        WallContext.clearContext();
+    }
+
+    protected void tearDown() throws Exception {
+        WallContext.clearContext();
+    }
+
+    public void testMySql() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setStrictSyntaxCheck(false);
+
+        String sql = "select xx * x *";
+        Assert.assertTrue(provider.checkValid(sql));
+        {
+            WallTableStat tableStat = provider.getTableStat("t");
+            Assert.assertEquals(0, tableStat.getSelectCount());
+            Assert.assertEquals(0, provider.getBlackListHitCount());
+            Assert.assertEquals(0, provider.getWhiteListHitCount());
+            Assert.assertEquals(1, provider.getWhiteList().size());
+            Assert.assertEquals(0, provider.getBlackList().size());
+            Assert.assertEquals(1, provider.getCheckCount());
+            Assert.assertEquals(1, provider.getSyntaxErrorCount());
+            Assert.assertEquals(1, provider.getHardCheckCount());
+        }
+        
+        Assert.assertTrue(provider.checkValid(sql));
+        {
+            WallTableStat tableStat = provider.getTableStat("t");
+            Assert.assertEquals(0, tableStat.getSelectCount());
+            Assert.assertEquals(0, provider.getBlackListHitCount());
+            Assert.assertEquals(1, provider.getWhiteListHitCount());
+            Assert.assertEquals(1, provider.getWhiteList().size());
+            Assert.assertEquals(0, provider.getBlackList().size());
+            Assert.assertEquals(2, provider.getCheckCount());
+            Assert.assertEquals(2, provider.getSyntaxErrorCount());
+            Assert.assertEquals(1, provider.getHardCheckCount());
+        }
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest.java

@@ -25,18 +25,30 @@ import com.alibaba.druid.wall.WallUtils;
 public class WallTruncateTest extends TestCase {
     private String sql = "TRUNCATE TABLE T1";
     
-    private WallConfig config = new WallConfig();
     
     protected void setUp() throws Exception {
         //config.setTruncateAllow(true);
     }
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+        WallConfig config = new WallConfig();
+        Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
     }
     
     public void testORACLE() throws Exception {
-        
+        WallConfig config = new WallConfig();
+        Assert.assertTrue(WallUtils.isValidateOracle(sql, config));
+    }
+    
+    public void testMySql_false() throws Exception {
+        WallConfig config = new WallConfig();
+        config.setTruncateAllow(false);
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+    
+    public void testORACLE_false() throws Exception {
+        WallConfig config = new WallConfig();
+        config.setTruncateAllow(false);
         Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
     }
 }

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlError_test.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+
+public class MySqlError_test extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "insert into userdetectitem26 (nick,volume) values(?,?) " + //
+                     "ON DUPLICATE KEY UPDATE title = ?,picURL = ?,scoreExceed = ?,score=";
+
+        Exception error = null;
+
+        try {
+            MySqlStatementParser parser = new MySqlStatementParser(sql);
+            parser.parseStatementList();
+        } catch (Exception e) {
+            error = e;
+        }
+        
+        Assert.assertNotNull(error);
+        Assert.assertEquals("EOF, score=", error.getMessage());
+    }
+}

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlError_test_1.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+
+public class MySqlError_test_1 extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "SELECT * FROM pp_items WHERE uid= ORDER BY id DESC LIMIT ?,?";
+        Exception error = null;
+
+        try {
+            MySqlStatementParser parser = new MySqlStatementParser(sql);
+            parser.parseStatementList();
+        } catch (Exception e) {
+            error = e;
+        }
+
+        Assert.assertNotNull(error);
+//        error.printStackTrace();
+        Assert.assertEquals("ERROR. token : ORDER, pos : 39", error.getMessage());
+    }
+}

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlError_test_2.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+
+public class MySqlError_test_2 extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "Describe sdb_goods free_postage";
+        Exception error = null;
+
+        try {
+            MySqlStatementParser parser = new MySqlStatementParser(sql);
+            parser.parseStatementList();
+        } catch (Exception e) {
+            error = e;
+        }
+
+        Assert.assertNotNull(error);
+//        error.printStackTrace();
+        Assert.assertEquals("syntax error, IDENTIFIER free_postage, pos 31", error.getMessage());
+    }
+}

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlError_test_3.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+
+public class MySqlError_test_3 extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "SELECT count(*) AS num FROM sdb_products AS P" + //
+                     " LEFT JOIN sdb_goods AS G ON G.goods_id = P.goods_id" + //
+                     " LEFT JOIN sdb_goods_cat AS C ON C.cat_id = G.cat_id" + //
+                     " LEFT JOIN sdb_brand AS B ON B.brand_id = G.brand_id" + //
+                     " WHERE P.disabled = ? AND P.op_status = LIMIT ?, ?";
+        Exception error = null;
+
+        try {
+            MySqlStatementParser parser = new MySqlStatementParser(sql);
+            parser.parseStatementList();
+        } catch (Exception e) {
+            error = e;
+        }
+
+        Assert.assertNotNull(error);
+//        error.printStackTrace();
+        Assert.assertEquals("syntax error, QUES LIMIT, pos 248", error.getMessage());
+    }
+}

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlSelectTest_9.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+import java.util.List;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.ast.statement.SQLSelect;
+import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
+import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlSchemaStatVisitor;
+import com.alibaba.druid.stat.TableStat;
+
+public class MySqlSelectTest_9 extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "SELECT `group`.* FROM `group` WHERE (group.group_id=159754)";
+
+        MySqlStatementParser parser = new MySqlStatementParser(sql);
+        List<SQLStatement> statementList = parser.parseStatementList();
+        SQLStatement stmt = statementList.get(0);
+        
+        SQLSelectStatement selectStmt = (SQLSelectStatement) stmt;
+        
+        SQLSelect select = selectStmt.getSelect();
+        Assert.assertNotNull(select.getQuery());
+        MySqlSelectQueryBlock queryBlock = (MySqlSelectQueryBlock) select.getQuery();
+        Assert.assertNull(queryBlock.getOrderBy());
+        
+        print(statementList);
+
+        Assert.assertEquals(1, statementList.size());
+
+        MySqlSchemaStatVisitor visitor = new MySqlSchemaStatVisitor();
+        stmt.accept(visitor);
+
+        Assert.assertEquals(1, visitor.getTables().size());
+        Assert.assertEquals(2, visitor.getColumns().size());
+        Assert.assertEquals(1, visitor.getConditions().size());
+        Assert.assertEquals(0, visitor.getOrderByColumns().size());
+
+        Assert.assertTrue(visitor.getTables().containsKey(new TableStat.Name("group")));
+    }
+}

src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlShowTest_table.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.mysql;
+
+import java.util.List;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.MysqlTest;
+import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.ast.statement.SQLSelect;
+import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
+import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
+import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlSchemaStatVisitor;
+
+public class MySqlShowTest_table extends MysqlTest {
+
+    public void test_0() throws Exception {
+        String sql = "SHOW FULL TABLES FROM sonar LIKE 'a'";
+
+        MySqlStatementParser parser = new MySqlStatementParser(sql);
+        List<SQLStatement> statementList = parser.parseStatementList();
+        SQLStatement stmt = statementList.get(0);
+
+        Assert.assertEquals(1, statementList.size());
+
+        MySqlSchemaStatVisitor visitor = new MySqlSchemaStatVisitor();
+        stmt.accept(visitor);
+
+        Assert.assertEquals(0, visitor.getTables().size());
+        Assert.assertEquals(0, visitor.getColumns().size());
+        Assert.assertEquals(0, visitor.getConditions().size());
+        Assert.assertEquals(0, visitor.getOrderByColumns().size());
+
+        // Assert.assertTrue(visitor.getTables().containsKey(new TableStat.Name("mytable")));
+    }
+}