add wall test

src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java

@@ -209,6 +209,19 @@ public class WallVisitorUtils {
                 return ((String) firstValue).length();
             }
         }
+        
+        if ("if".equalsIgnoreCase(methodName) && x.getParameters().size() == 3) {
+            SQLExpr first = x.getParameters().get(0);
+            Object firstResult = getValue(first);
+            
+            if (Boolean.TRUE == firstResult) {
+                return getValue(x.getParameters().get(1));
+            }
+            
+            if (Boolean.FALSE == firstResult) {
+                getValue(x.getParameters().get(2));
+            }
+        }
 
         return null;
     }
@@ -277,6 +290,8 @@ public class WallVisitorUtils {
 
             if (propExpr.getOwner() instanceof SQLIdentifierExpr) {
                 String ownerName = ((SQLIdentifierExpr) propExpr.getOwner()).getName();
+                
+                ownerName = form(ownerName);
 
                 if (visitor.getPermitSchemas().contains(ownerName.toLowerCase())) {
                     visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
@@ -327,6 +342,9 @@ public class WallVisitorUtils {
         if (name.startsWith("\"") && name.endsWith("\"")) {
             name = name.substring(1, name.length() - 1);
         }
+        if (name.startsWith("`") && name.endsWith("`")) {
+            name = name.substring(1, name.length() - 1);
+        }
         
         name = name.toLowerCase();
         return name;

src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java

@@ -273,9 +273,9 @@ public class SQLExprParser extends SQLParser {
 
                     accept(Token.RPAREN);
                     notTarget = exprRest(notTarget);
-                    
+
                     sqlExpr = new SQLNotExpr(notTarget);
-                    
+
                     return primaryRest(sqlExpr);
                 } else {
                     SQLExpr restExpr = expr();
@@ -468,6 +468,11 @@ public class SQLExprParser extends SQLParser {
         if (lexer.token() == Token.DOT) {
             lexer.nextToken();
 
+            if (expr instanceof SQLCharExpr) {
+                String text = ((SQLCharExpr) expr).getText();
+                expr = new SQLIdentifierExpr(text);
+            }
+
             expr = dotRest(expr);
             return primaryRest(expr);
         } else if (lexer.token() == Token.COLONEQ) {
@@ -635,7 +640,11 @@ public class SQLExprParser extends SQLParser {
                 throw new ParserException("error, " + lexer.token());
             }
 
-            name = new SQLPropertyExpr(name, lexer.stringVal());
+            if (lexer.token() == Token.LITERAL_ALIAS) {
+                name = new SQLPropertyExpr(name, '"' + lexer.stringVal() + '"');
+            } else {
+                name = new SQLPropertyExpr(name, lexer.stringVal());
+            }
             lexer.nextToken();
         }
 

src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java

@@ -227,6 +227,11 @@ public class SQLSelectParser extends SQLParser {
     }
 
     private void parseTableSourceQueryTableExpr(SQLExprTableSource tableReference) throws ParserException {
+        if (lexer.token() == Token.LITERAL_ALIAS || lexer.token() == Token.IDENTIFIED || lexer.token() == Token.LITERAL_CHARS) {
+            tableReference.setExpr(this.createExprParser().name());
+            return;
+        }
+        
         tableReference.setExpr(expr());
     }
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java

@@ -0,0 +1,29 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+import junit.framework.TestCase;
+
+/**
+ * 这个场景测试访问MySql系统表
+ * 
+ * @author admin
+ */
+public class MySqlWallPermitTableTest extends TestCase {
+
+    public void test_permitTable() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM mysql.user"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM `mysql`.`user`"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM \"mysql\".\"user\""));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM MYSQL.USER"));
+    }
+    
+    public void test_permitTable_subquery() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a"));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java

@@ -0,0 +1,23 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * @author wenshao
+ *
+ */
+public class WallUnionTest2 extends TestCase {
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2 where 1 = 1"));
+    }
+
+    public void testOracle() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2 where 1 = 1"));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest3.java

@@ -0,0 +1,21 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * @author wenshao
+ *
+ */
+public class WallUnionTest3 extends TestCase {
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x';"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;"));
+    }
+}

src/test/java/com/alibaba/druid/sql/TestOnlineSQLTest3.java

@@ -7,15 +7,18 @@ import java.sql.Statement;
 
 import junit.framework.TestCase;
 
+import com.alibaba.druid.util.JdbcUtils;
+
 public class TestOnlineSQLTest3 extends TestCase {
 
-    private String       url      = "jdbc:mysql://10.249.192.221/test";
-    private String       user     = "dragoon";
-    private String       password = "dragoon";
+    private String       url      = "jdbc:mysql://10.20.144.27/dragoon_v25_masterdb";
+    private String       user     = "dragoon_test";
+    private String       password = "dragoon_test";
 
     protected Connection conn;
 
     public void setUp() throws Exception {
+        Class.forName("com.mysql.jdbc.Driver");
         conn = DriverManager.getConnection(url, user, password);
     }
 
@@ -27,23 +30,15 @@ public class TestOnlineSQLTest3 extends TestCase {
     }
 
     public void test_0() throws Exception {
-        String sql = "SELECT * FROM m_sql_const";
+//        ResultSet rs = conn.getMetaData().getTables(null, null, null, null);
+//        JdbcUtils.printResultSet(rs);
+        
+        String sql = "SELECT User,Password FROM mysql.user;";
         Statement stmt = conn.createStatement();
 
         ResultSet rs = stmt.executeQuery(sql);
-        while (rs.next()) {
-            long id = rs.getLong(1);
-            String value = rs.getString(2);
-            handle(id, value);
-        }
-        rs.close();
-
+        JdbcUtils.printResultSet(rs);
+        
         stmt.close();
     }
-
-    void handle(long id, String value) {
-        String sql = value.toString();
-
-        System.out.println(sql);
-    }
 }