add wall test

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java

@@ -0,0 +1,29 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+import junit.framework.TestCase;
+
+/**
+ * 这个场景测试访问MySql系统表
+ * 
+ * @author admin
+ */
+public class MySqlWallPermitTableTest extends TestCase {
+
+    public void test_permitTable() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM mysql.user"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM `mysql`.`user`"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM \"mysql\".\"user\""));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM MYSQL.USER"));
+    }
+    
+    public void test_permitTable_subquery() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM mysql.user) a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM `mysql`.`user`) a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM \"mysql\".\"user\") a"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from(SELECT User,Password FROM MYSQL.USER) a"));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java

@@ -0,0 +1,23 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * @author wenshao
+ *
+ */
+public class WallUnionTest2 extends TestCase {
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2 where 1 = 1"));
+    }
+
+    public void testOracle() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2 where 1 = 1"));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest3.java

@@ -0,0 +1,21 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * @author wenshao
+ *
+ */
+public class WallUnionTest3 extends TestCase {
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x';"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;"));
+    }
+}

src/test/java/com/alibaba/druid/sql/TestOnlineSQLTest3.java

@@ -7,15 +7,18 @@ import java.sql.Statement;
 
 import junit.framework.TestCase;
 
+import com.alibaba.druid.util.JdbcUtils;
+
 public class TestOnlineSQLTest3 extends TestCase {
 
-    private String       url      = "jdbc:mysql://10.249.192.221/test";
-    private String       user     = "dragoon";
-    private String       password = "dragoon";
+    private String       url      = "jdbc:mysql://10.20.144.27/dragoon_v25_masterdb";
+    private String       user     = "dragoon_test";
+    private String       password = "dragoon_test";
 
     protected Connection conn;
 
     public void setUp() throws Exception {
+        Class.forName("com.mysql.jdbc.Driver");
         conn = DriverManager.getConnection(url, user, password);
     }
 
@@ -27,23 +30,15 @@ public class TestOnlineSQLTest3 extends TestCase {
     }
 
     public void test_0() throws Exception {
-        String sql = "SELECT * FROM m_sql_const";
+//        ResultSet rs = conn.getMetaData().getTables(null, null, null, null);
+//        JdbcUtils.printResultSet(rs);
+        
+        String sql = "SELECT User,Password FROM mysql.user;";
         Statement stmt = conn.createStatement();
 
         ResultSet rs = stmt.executeQuery(sql);
-        while (rs.next()) {
-            long id = rs.getLong(1);
-            String value = rs.getString(2);
-            handle(id, value);
-        }
-        rs.close();
-
+        JdbcUtils.printResultSet(rs);
+        
         stmt.close();
     }
-
-    void handle(long id, String value) {
-        String sql = value.toString();
-
-        System.out.println(sql);
-    }
 }