diff --git a/src/main/java/com/alibaba/druid/sql/SQLUtils.java b/src/main/java/com/alibaba/druid/sql/SQLUtils.java index 10a36ef8dd..664118193e 100644 --- a/src/main/java/com/alibaba/druid/sql/SQLUtils.java +++ b/src/main/java/com/alibaba/druid/sql/SQLUtils.java @@ -31,7 +31,6 @@ import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerOutputVisitor; import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerSchemaStatVisitor; import com.alibaba.druid.sql.parser.ParserException; import com.alibaba.druid.sql.parser.SQLExprParser; -import com.alibaba.druid.sql.parser.SQLParseException; import com.alibaba.druid.sql.parser.SQLParserUtils; import com.alibaba.druid.sql.parser.SQLStatementParser; import com.alibaba.druid.sql.parser.Token; @@ -150,9 +149,6 @@ public class SQLUtils { List statementList = toStatementList(sql, dbType); return toSQLString(statementList, dbType, parameters); - } catch (SQLParseException ex) { - LOG.warn("format error", ex); - return sql; } catch (ParserException ex) { LOG.warn("format error", ex); return sql; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java index 0b70649d41..7d13919037 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java @@ -27,7 +27,6 @@ import com.alibaba.druid.sql.parser.Keywords; import com.alibaba.druid.sql.parser.Lexer; import com.alibaba.druid.sql.parser.NotAllowCommentException; import com.alibaba.druid.sql.parser.ParserException; -import com.alibaba.druid.sql.parser.SQLParseException; import com.alibaba.druid.sql.parser.Token; public class MySqlLexer extends Lexer { @@ -64,7 +63,7 @@ public class MySqlLexer extends Lexer { public void scanVariable() { if (ch != '@' && ch != ':' && ch != '#' && ch != '$') { - throw new SQLParseException("illegal variable"); + throw new ParserException("illegal variable"); } mark = pos; @@ -87,7 +86,7 @@ public class MySqlLexer extends Lexer { ch = charAt(++pos); break; } else if (ch == EOI) { - throw new SQLParseException("illegal identifier"); + throw new ParserException("illegal identifier"); } bufPos++; @@ -110,7 +109,7 @@ public class MySqlLexer extends Lexer { ch = charAt(++pos); break; } else if (ch == EOI) { - throw new SQLParseException("illegal identifier"); + throw new ParserException("illegal identifier"); } bufPos++; @@ -156,7 +155,7 @@ public class MySqlLexer extends Lexer { ch = charAt(++pos); break; } else if (ch == EOI) { - throw new SQLParseException("illegal identifier"); + throw new ParserException("illegal identifier"); } bufPos++; @@ -176,7 +175,7 @@ public class MySqlLexer extends Lexer { final boolean firstFlag = isFirstIdentifierChar(first); if (!firstFlag) { - throw new SQLParseException("illegal identifier"); + throw new ParserException("illegal identifier"); } mark = pos; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java index a35ad13013..d45e69c51a 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java @@ -138,7 +138,6 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnlockTablesStatem import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement; import com.alibaba.druid.sql.parser.Lexer; import com.alibaba.druid.sql.parser.ParserException; -import com.alibaba.druid.sql.parser.SQLParseException; import com.alibaba.druid.sql.parser.SQLSelectParser; import com.alibaba.druid.sql.parser.SQLStatementParser; import com.alibaba.druid.sql.parser.Token; @@ -1860,7 +1859,7 @@ public class MySqlStatementParser extends SQLStatementParser { private void parseValueClause(List valueClauseList, int columnSize) { for (;;) { if (lexer.token() != Token.LPAREN) { - throw new SQLParseException("syntax error, expect ')'"); + throw new ParserException("syntax error, expect ')'"); } lexer.nextTokenValue(); @@ -1914,7 +1913,7 @@ public class MySqlStatementParser extends SQLStatementParser { } if (lexer.token() != Token.RPAREN) { - throw new SQLParseException("syntax error"); + throw new ParserException("syntax error"); } lexer.nextTokenComma(); diff --git a/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java index efd7611eb2..830272c9a8 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java @@ -16,6 +16,7 @@ package com.alibaba.druid.sql.dialect.oracle.parser; import static com.alibaba.druid.sql.parser.CharTypes.isIdentifierChar; +import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI; import java.util.HashMap; import java.util.Map; @@ -23,11 +24,9 @@ import java.util.Map; import com.alibaba.druid.sql.parser.Keywords; import com.alibaba.druid.sql.parser.Lexer; import com.alibaba.druid.sql.parser.NotAllowCommentException; -import com.alibaba.druid.sql.parser.SQLParseException; +import com.alibaba.druid.sql.parser.ParserException; import com.alibaba.druid.sql.parser.Token; -import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI; - public class OracleLexer extends Lexer { public final static Keywords DEFAULT_ORACLE_KEYWORDS; @@ -104,7 +103,7 @@ public class OracleLexer extends Lexer { } if (ch != ':' && ch != '#' && ch != '$') { - throw new SQLParseException("illegal variable"); + throw new ParserException("illegal variable"); } mark = pos; @@ -136,13 +135,13 @@ public class OracleLexer extends Lexer { if (quoteFlag) { if (ch != '"') { - throw new SQLParseException("syntax error"); + throw new ParserException("syntax error"); } ++pos; bufPos++; } else if (mybatisFlag) { if (ch != '}') { - throw new SQLParseException("syntax error"); + throw new ParserException("syntax error"); } ++pos; bufPos++; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleSelectParser.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleSelectParser.java index 1d7636d8b7..353ef149f1 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleSelectParser.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleSelectParser.java @@ -67,7 +67,6 @@ import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectTableSource; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectUnPivot; import com.alibaba.druid.sql.parser.ParserException; import com.alibaba.druid.sql.parser.SQLExprParser; -import com.alibaba.druid.sql.parser.SQLParseException; import com.alibaba.druid.sql.parser.SQLSelectParser; import com.alibaba.druid.sql.parser.Token; @@ -182,7 +181,7 @@ public class OracleSelectParser extends SQLSelectParser { SearchClause searchClause = new SearchClause(); if (lexer.token() != Token.IDENTIFIER) { - throw new SQLParseException("syntax erorr : " + lexer.token()); + throw new ParserException("syntax erorr : " + lexer.token()); } searchClause.setType(SearchClause.Type.valueOf(lexer.stringVal())); @@ -823,7 +822,7 @@ public class OracleSelectParser extends SQLSelectParser { SQLBinaryOpExpr binaryExpr = (SQLBinaryOpExpr) exprParser.expr(); if (binaryExpr.getOperator() != SQLBinaryOperator.BooleanAnd) { - throw new SQLParseException("syntax error : " + binaryExpr.getOperator()); + throw new ParserException("syntax error : " + binaryExpr.getOperator()); } clause.setBegin(binaryExpr.getLeft()); @@ -831,7 +830,7 @@ public class OracleSelectParser extends SQLSelectParser { tableReference.setFlashback(clause); } else { - throw new SQLParseException("TODO"); + throw new ParserException("TODO"); } } diff --git a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java index d8129e9aef..267d07491e 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java +++ b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java @@ -19,8 +19,8 @@ import static com.alibaba.druid.sql.parser.CharTypes.isFirstIdentifierChar; import static com.alibaba.druid.sql.parser.CharTypes.isIdentifierChar; import static com.alibaba.druid.sql.parser.CharTypes.isWhitespace; import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI; -import static com.alibaba.druid.sql.parser.Token.COLONEQ; import static com.alibaba.druid.sql.parser.Token.COLONCOLON; +import static com.alibaba.druid.sql.parser.Token.COLONEQ; import static com.alibaba.druid.sql.parser.Token.COMMA; import static com.alibaba.druid.sql.parser.Token.EOF; import static com.alibaba.druid.sql.parser.Token.ERROR; @@ -389,7 +389,7 @@ public class Lexer { token = Token.SEMI; return; case '`': - throw new SQLParseException("TODO"); // TODO + throw new ParserException("TODO"); // TODO case '@': scanVariable(); return; @@ -557,7 +557,7 @@ public class Lexer { token = Token.TILDE; break; default: - throw new SQLParseException("TODO"); + throw new ParserException("TODO"); } } @@ -641,7 +641,7 @@ public class Lexer { public void scanVariable() { if (ch != '@' && ch != ':' && ch != '#' && ch != '$') { - throw new SQLParseException("illegal variable"); + throw new ParserException("illegal variable"); } mark = pos; @@ -672,7 +672,7 @@ public class Lexer { if (mybatisFlag) { if (ch != '}') { - throw new SQLParseException("syntax error"); + throw new ParserException("syntax error"); } ++pos; bufPos++; @@ -754,7 +754,7 @@ public class Lexer { final boolean firstFlag = isFirstIdentifierChar(first); if (!firstFlag) { - throw new SQLParseException("illegal identifier"); + throw new ParserException("illegal identifier"); } mark = pos; diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java index e3aefb6180..b397a1a84c 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java @@ -706,12 +706,12 @@ public class SQLExprParser extends SQLParser { exprList(aggregateExpr.getArguments()); accept(Token.RPAREN); - + if (lexer.token() == Token.OVER) { lexer.nextToken(); SQLOver over = new SQLOver(); accept(Token.LPAREN); - + if (identifierEquals("PARTITION")) { lexer.nextToken(); accept(Token.BY); @@ -725,13 +725,12 @@ public class SQLExprParser extends SQLParser { } } - over.setOrderBy(parseOrderBy()); - + // if (over.getOrderBy() != null) { // //TODO window // } - + accept(Token.RPAREN); aggregateExpr.setOver(over); @@ -1133,16 +1132,16 @@ public class SQLExprParser extends SQLParser { SQLName typeExpr = name(); String typeName = typeExpr.toString(); - + if (isCharType(typeName)) { SQLCharactorDataType charType = new SQLCharactorDataType(typeName); - + if (lexer.token() == Token.LPAREN) { lexer.nextToken(); charType.getArguments().add(this.expr()); accept(Token.RPAREN); } - + return parseCharTypeRest(charType); } @@ -1205,8 +1204,8 @@ public class SQLExprParser extends SQLParser { if (lexer.token() == token) { lexer.nextToken(); } else { - throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " " - + lexer.stringVal()); + throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " " + + lexer.stringVal()); } } @@ -1237,19 +1236,19 @@ public class SQLExprParser extends SQLParser { column.setDefaultExpr(new SQLNullExpr()); return parseColumnRest(column); } - + if (lexer.token == Token.PRIMARY) { lexer.nextToken(); accept(Token.KEY); column.getConstaints().add(new SQLColumnPrimaryKey()); - return parseColumnRest(column); + return parseColumnRest(column); } - + if (lexer.token == Token.UNION) { lexer.nextToken(); accept(Token.KEY); column.getConstaints().add(new SQLColumnPrimaryKey()); - return parseColumnRest(column); + return parseColumnRest(column); } return column; diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLParseException.java b/src/main/java/com/alibaba/druid/sql/parser/SQLParseException.java index c1d6037344..655e0c5db8 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLParseException.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLParseException.java @@ -20,6 +20,7 @@ import com.alibaba.druid.DruidRuntimeException; /** * @author wenshao */ +@Deprecated public class SQLParseException extends DruidRuntimeException { private static final long serialVersionUID = 1L; diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java index 3f7e53eace..b725a2d636 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java @@ -41,7 +41,7 @@ public class SQLParser { lexer.nextToken(); } else { setErrorEndPos(lexer.pos()); - throw new SQLParseException("syntax error, expect " + text + ", actual " + lexer.token()); + throw new ParserException("syntax error, expect " + text + ", actual " + lexer.token()); } } @@ -124,14 +124,14 @@ public class SQLParser { lexer.nextToken(); } else { setErrorEndPos(lexer.pos()); - throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " " + throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " " + lexer.stringVal() + ", pos " + this.lexer.pos()); } } public void match(Token token) { if (lexer.token() != token) { - throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " " + throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " " + lexer.stringVal()); } } diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java index 6b51a81f55..53c0afe809 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java @@ -416,7 +416,7 @@ public class SQLSelectParser extends SQLParser { lexer.nextToken(); } else { setErrorEndPos(lexer.pos()); - throw new SQLParseException("syntax error, expect " + ident + ", actual " + lexer.token()); + throw new ParserException("syntax error, expect " + ident + ", actual " + lexer.token()); } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 86fa10593e..517e2b9191 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -256,28 +256,39 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } boolean allow = false; + String denyMessage = null; if (x instanceof SQLInsertStatement) { allow = true; + denyMessage = "insert not allow"; } else if (x instanceof SQLSelectStatement) { allow = true; + denyMessage = "select not allow"; } else if (x instanceof SQLDeleteStatement) { allow = true; + denyMessage = "delete not allow"; } else if (x instanceof SQLUpdateStatement) { allow = true; + denyMessage = "update not allow"; } else if (x instanceof SQLCallStatement) { allow = true; + denyMessage = "call not allow"; } else if (x instanceof SQLTruncateStatement) { allow = config.isTruncateAllow(); + denyMessage = "truncate not allow"; } else if (x instanceof MySqlDescribeStatement) { allow = config.isDescribeAllow(); + denyMessage = "describe not allow"; } else if (x instanceof MySqlReplaceStatement) { allow = config.isReplaceAllow(); + denyMessage = "replace not allow"; } else if (x instanceof MySqlSetCharSetStatement // || x instanceof MySqlSetNamesStatement // || x instanceof SQLSetStatement) { allow = config.isSetAllow(); + denyMessage = "set not allow"; } else if (x instanceof MySqlShowStatement) { allow = config.isShowAllow(); + denyMessage = "show not allow"; } else { if (config.isNoneBaseStatementAllow()) { return; @@ -285,7 +296,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } if (!allow) { - violations.add(new IllegalSQLObjectViolation(x.getClass() + " not allow", toSQL(x))); + if (denyMessage == null) { + denyMessage = x.getClass() + " not allow"; + } + violations.add(new IllegalSQLObjectViolation(denyMessage + " not allow", toSQL(x))); } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 882ee67fc9..4ba2b46c97 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -366,11 +366,11 @@ public class WallVisitorUtils { if (x instanceof MySqlUpdateStatement) { MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x; if (mysqlUpdate.getLimit() == null) { - addViolation(visitor, "update alway true condition not allow", x); + addViolation(visitor, "update none condition not allow", x); return; } } else { - addViolation(visitor, "update alway true condition not allow", x); + addViolation(visitor, "update none condition not allow", x); return; } } diff --git a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java index 03bcbdf33c..d13ee4e68b 100644 --- a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java +++ b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java @@ -22,11 +22,8 @@ public class IllegalSQLObjectViolation implements Violation { private String message; private String sqlPart; - public IllegalSQLObjectViolation(){ - - } - public IllegalSQLObjectViolation(String message, String condition){ + this.message = message; this.sqlPart = condition; } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest33.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest33.java new file mode 100644 index 0000000000..7431684e2d --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest33.java @@ -0,0 +1,45 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest33 extends TestCase { + + public void test_false() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "DELETE FROM lhwdesign_data WHERE data_id IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?")); // + } + + public void test_true() throws Exception { + WallConfig config = new WallConfig(); + config.setStrictSyntaxCheck(false); + Assert.assertTrue(WallUtils.isValidateMySql(// + "DELETE FROM lhwdesign_data WHERE data_id IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?", config)); // + } +}