Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve WallFilter

Browse Source
This commit is contained in:
wenshao
2013-04-01 11:04:38 +08:00
parent 8b6672debf
commit 7a49a6ce35
14 changed files with 102 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/SQLUtils.java
-4
View File
@@ -31,7 +31,6 @@ import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerOutputVisitor;
import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerSchemaStatVisitor;
import com.alibaba.druid.sql.parser.ParserException;
import com.alibaba.druid.sql.parser.SQLExprParser;
import com.alibaba.druid.sql.parser.SQLParseException;
import com.alibaba.druid.sql.parser.SQLParserUtils;
import com.alibaba.druid.sql.parser.SQLStatementParser;
import com.alibaba.druid.sql.parser.Token;
@@ -150,9 +149,6 @@ public class SQLUtils {
List<SQLStatement> statementList = toStatementList(sql, dbType);
return toSQLString(statementList, dbType, parameters);
} catch (SQLParseException ex) {
LOG.warn("format error", ex);
return sql;
} catch (ParserException ex) {
LOG.warn("format error", ex);
return sql;
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+5 -6
View File
@@ -27,7 +27,6 @@ import com.alibaba.druid.sql.parser.Keywords;
import com.alibaba.druid.sql.parser.Lexer;
import com.alibaba.druid.sql.parser.NotAllowCommentException;
import com.alibaba.druid.sql.parser.ParserException;
import com.alibaba.druid.sql.parser.SQLParseException;
import com.alibaba.druid.sql.parser.Token;
public class MySqlLexer extends Lexer {
@@ -64,7 +63,7 @@ public class MySqlLexer extends Lexer {
public void scanVariable() {
if (ch != '@' && ch != ':' && ch != '#' && ch != '$') {
throw new SQLParseException("illegal variable");
throw new ParserException("illegal variable");
}
mark = pos;
@@ -87,7 +86,7 @@ public class MySqlLexer extends Lexer {
ch = charAt(++pos);
break;
} else if (ch == EOI) {
throw new SQLParseException("illegal identifier");
throw new ParserException("illegal identifier");
}
bufPos++;
@@ -110,7 +109,7 @@ public class MySqlLexer extends Lexer {
ch = charAt(++pos);
break;
} else if (ch == EOI) {
throw new SQLParseException("illegal identifier");
throw new ParserException("illegal identifier");
}
bufPos++;
@@ -156,7 +155,7 @@ public class MySqlLexer extends Lexer {
ch = charAt(++pos);
break;
} else if (ch == EOI) {
throw new SQLParseException("illegal identifier");
throw new ParserException("illegal identifier");
}
bufPos++;
@@ -176,7 +175,7 @@ public class MySqlLexer extends Lexer {
final boolean firstFlag = isFirstIdentifierChar(first);
if (!firstFlag) {
throw new SQLParseException("illegal identifier");
throw new ParserException("illegal identifier");
}
mark = pos;
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlStatementParser.java
+2 -3
View File
@@ -138,7 +138,6 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnlockTablesStatem
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement;
import com.alibaba.druid.sql.parser.Lexer;
import com.alibaba.druid.sql.parser.ParserException;
import com.alibaba.druid.sql.parser.SQLParseException;
import com.alibaba.druid.sql.parser.SQLSelectParser;
import com.alibaba.druid.sql.parser.SQLStatementParser;
import com.alibaba.druid.sql.parser.Token;
@@ -1860,7 +1859,7 @@ public class MySqlStatementParser extends SQLStatementParser {
private void parseValueClause(List<ValuesClause> valueClauseList, int columnSize) {
for (;;) {
if (lexer.token() != Token.LPAREN) {
throw new SQLParseException("syntax error, expect ')'");
throw new ParserException("syntax error, expect ')'");
}
lexer.nextTokenValue();
@@ -1914,7 +1913,7 @@ public class MySqlStatementParser extends SQLStatementParser {
}
if (lexer.token() != Token.RPAREN) {
throw new SQLParseException("syntax error");
throw new ParserException("syntax error");
}
lexer.nextTokenComma();
src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java
+5 -6
View File
@@ -16,6 +16,7 @@
package com.alibaba.druid.sql.dialect.oracle.parser;
import static com.alibaba.druid.sql.parser.CharTypes.isIdentifierChar;
import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI;
import java.util.HashMap;
import java.util.Map;
@@ -23,11 +24,9 @@ import java.util.Map;
import com.alibaba.druid.sql.parser.Keywords;
import com.alibaba.druid.sql.parser.Lexer;
import com.alibaba.druid.sql.parser.NotAllowCommentException;
import com.alibaba.druid.sql.parser.SQLParseException;
import com.alibaba.druid.sql.parser.ParserException;
import com.alibaba.druid.sql.parser.Token;
import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI;
public class OracleLexer extends Lexer {
public final static Keywords DEFAULT_ORACLE_KEYWORDS;
@@ -104,7 +103,7 @@ public class OracleLexer extends Lexer {
}
if (ch != ':' && ch != '#' && ch != '$') {
throw new SQLParseException("illegal variable");
throw new ParserException("illegal variable");
}
mark = pos;
@@ -136,13 +135,13 @@ public class OracleLexer extends Lexer {
if (quoteFlag) {
if (ch != '"') {
throw new SQLParseException("syntax error");
throw new ParserException("syntax error");
}
++pos;
bufPos++;
} else if (mybatisFlag) {
if (ch != '}') {
throw new SQLParseException("syntax error");
throw new ParserException("syntax error");
}
++pos;
bufPos++;
src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleSelectParser.java
+3 -4
View File
@@ -67,7 +67,6 @@ import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectTableSource;
import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectUnPivot;
import com.alibaba.druid.sql.parser.ParserException;
import com.alibaba.druid.sql.parser.SQLExprParser;
import com.alibaba.druid.sql.parser.SQLParseException;
import com.alibaba.druid.sql.parser.SQLSelectParser;
import com.alibaba.druid.sql.parser.Token;
@@ -182,7 +181,7 @@ public class OracleSelectParser extends SQLSelectParser {
SearchClause searchClause = new SearchClause();
if (lexer.token() != Token.IDENTIFIER) {
throw new SQLParseException("syntax erorr : " + lexer.token());
throw new ParserException("syntax erorr : " + lexer.token());
}
searchClause.setType(SearchClause.Type.valueOf(lexer.stringVal()));
@@ -823,7 +822,7 @@ public class OracleSelectParser extends SQLSelectParser {
SQLBinaryOpExpr binaryExpr = (SQLBinaryOpExpr) exprParser.expr();
if (binaryExpr.getOperator() != SQLBinaryOperator.BooleanAnd) {
throw new SQLParseException("syntax error : " + binaryExpr.getOperator());
throw new ParserException("syntax error : " + binaryExpr.getOperator());
}
clause.setBegin(binaryExpr.getLeft());
@@ -831,7 +830,7 @@ public class OracleSelectParser extends SQLSelectParser {
tableReference.setFlashback(clause);
} else {
throw new SQLParseException("TODO");
throw new ParserException("TODO");
}
}
src/main/java/com/alibaba/druid/sql/parser/Lexer.java
+6 -6
View File
@@ -19,8 +19,8 @@ import static com.alibaba.druid.sql.parser.CharTypes.isFirstIdentifierChar;
import static com.alibaba.druid.sql.parser.CharTypes.isIdentifierChar;
import static com.alibaba.druid.sql.parser.CharTypes.isWhitespace;
import static com.alibaba.druid.sql.parser.LayoutCharacters.EOI;
import static com.alibaba.druid.sql.parser.Token.COLONEQ;
import static com.alibaba.druid.sql.parser.Token.COLONCOLON;
import static com.alibaba.druid.sql.parser.Token.COLONEQ;
import static com.alibaba.druid.sql.parser.Token.COMMA;
import static com.alibaba.druid.sql.parser.Token.EOF;
import static com.alibaba.druid.sql.parser.Token.ERROR;
@@ -389,7 +389,7 @@ public class Lexer {
token = Token.SEMI;
return;
case '`':
throw new SQLParseException("TODO"); // TODO
throw new ParserException("TODO"); // TODO
case '@':
scanVariable();
return;
@@ -557,7 +557,7 @@ public class Lexer {
token = Token.TILDE;
break;
default:
throw new SQLParseException("TODO");
throw new ParserException("TODO");
}
}
@@ -641,7 +641,7 @@ public class Lexer {
public void scanVariable() {
if (ch != '@' && ch != ':' && ch != '#' && ch != '$') {
throw new SQLParseException("illegal variable");
throw new ParserException("illegal variable");
}
mark = pos;
@@ -672,7 +672,7 @@ public class Lexer {
if (mybatisFlag) {
if (ch != '}') {
throw new SQLParseException("syntax error");
throw new ParserException("syntax error");
}
++pos;
bufPos++;
@@ -754,7 +754,7 @@ public class Lexer {
final boolean firstFlag = isFirstIdentifierChar(first);
if (!firstFlag) {
throw new SQLParseException("illegal identifier");
throw new ParserException("illegal identifier");
}
mark = pos;
src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java
+13 -14
View File
@@ -706,12 +706,12 @@ public class SQLExprParser extends SQLParser {
exprList(aggregateExpr.getArguments());
accept(Token.RPAREN);
if (lexer.token() == Token.OVER) {
lexer.nextToken();
SQLOver over = new SQLOver();
accept(Token.LPAREN);
if (identifierEquals("PARTITION")) {
lexer.nextToken();
accept(Token.BY);
@@ -725,13 +725,12 @@ public class SQLExprParser extends SQLParser {
}
}
over.setOrderBy(parseOrderBy());
// if (over.getOrderBy() != null) {
// //TODO window
// }
accept(Token.RPAREN);
aggregateExpr.setOver(over);
@@ -1133,16 +1132,16 @@ public class SQLExprParser extends SQLParser {
SQLName typeExpr = name();
String typeName = typeExpr.toString();
if (isCharType(typeName)) {
SQLCharactorDataType charType = new SQLCharactorDataType(typeName);
if (lexer.token() == Token.LPAREN) {
lexer.nextToken();
charType.getArguments().add(this.expr());
accept(Token.RPAREN);
}
return parseCharTypeRest(charType);
}
@@ -1205,8 +1204,8 @@ public class SQLExprParser extends SQLParser {
if (lexer.token() == token) {
lexer.nextToken();
} else {
throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " "
+ lexer.stringVal());
throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " "
+ lexer.stringVal());
}
}
@@ -1237,19 +1236,19 @@ public class SQLExprParser extends SQLParser {
column.setDefaultExpr(new SQLNullExpr());
return parseColumnRest(column);
}
if (lexer.token == Token.PRIMARY) {
lexer.nextToken();
accept(Token.KEY);
column.getConstaints().add(new SQLColumnPrimaryKey());
return parseColumnRest(column);
return parseColumnRest(column);
}
if (lexer.token == Token.UNION) {
lexer.nextToken();
accept(Token.KEY);
column.getConstaints().add(new SQLColumnPrimaryKey());
return parseColumnRest(column);
return parseColumnRest(column);
}
return column;
src/main/java/com/alibaba/druid/sql/parser/SQLParseException.java
+1
View File
@@ -20,6 +20,7 @@ import com.alibaba.druid.DruidRuntimeException;
/**
* @author wenshao<szujobs@hotmail.com>
*/
@Deprecated
public class SQLParseException extends DruidRuntimeException {
private static final long serialVersionUID = 1L;
src/main/java/com/alibaba/druid/sql/parser/SQLParser.java
+3 -3
View File
@@ -41,7 +41,7 @@ public class SQLParser {
lexer.nextToken();
} else {
setErrorEndPos(lexer.pos());
throw new SQLParseException("syntax error, expect " + text + ", actual " + lexer.token());
throw new ParserException("syntax error, expect " + text + ", actual " + lexer.token());
}
}
@@ -124,14 +124,14 @@ public class SQLParser {
lexer.nextToken();
} else {
setErrorEndPos(lexer.pos());
throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " "
throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " "
+ lexer.stringVal() + ", pos " + this.lexer.pos());
}
}
public void match(Token token) {
if (lexer.token() != token) {
throw new SQLParseException("syntax error, expect " + token + ", actual " + lexer.token() + " "
throw new ParserException("syntax error, expect " + token + ", actual " + lexer.token() + " "
+ lexer.stringVal());
}
}
src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java
+1 -1
View File
@@ -416,7 +416,7 @@ public class SQLSelectParser extends SQLParser {
lexer.nextToken();
} else {
setErrorEndPos(lexer.pos());
throw new SQLParseException("syntax error, expect " + ident + ", actual " + lexer.token());
throw new ParserException("syntax error, expect " + ident + ", actual " + lexer.token());
}
}
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+15 -1
View File
@@ -256,28 +256,39 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
}
boolean allow = false;
String denyMessage = null;
if (x instanceof SQLInsertStatement) {
allow = true;
denyMessage = "insert not allow";
} else if (x instanceof SQLSelectStatement) {
allow = true;
denyMessage = "select not allow";
} else if (x instanceof SQLDeleteStatement) {
allow = true;
denyMessage = "delete not allow";
} else if (x instanceof SQLUpdateStatement) {
allow = true;
denyMessage = "update not allow";
} else if (x instanceof SQLCallStatement) {
allow = true;
denyMessage = "call not allow";
} else if (x instanceof SQLTruncateStatement) {
allow = config.isTruncateAllow();
denyMessage = "truncate not allow";
} else if (x instanceof MySqlDescribeStatement) {
allow = config.isDescribeAllow();
denyMessage = "describe not allow";
} else if (x instanceof MySqlReplaceStatement) {
allow = config.isReplaceAllow();
denyMessage = "replace not allow";
} else if (x instanceof MySqlSetCharSetStatement //
|| x instanceof MySqlSetNamesStatement //
|| x instanceof SQLSetStatement) {
allow = config.isSetAllow();
denyMessage = "set not allow";
} else if (x instanceof MySqlShowStatement) {
allow = config.isShowAllow();
denyMessage = "show not allow";
} else {
if (config.isNoneBaseStatementAllow()) {
return;
@@ -285,7 +296,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
}
if (!allow) {
violations.add(new IllegalSQLObjectViolation(x.getClass() + " not allow", toSQL(x)));
if (denyMessage == null) {
denyMessage = x.getClass() + " not allow";
}
violations.add(new IllegalSQLObjectViolation(denyMessage + " not allow", toSQL(x)));
}
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+2 -2
View File
@@ -366,11 +366,11 @@ public class WallVisitorUtils {
if (x instanceof MySqlUpdateStatement) {
MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
if (mysqlUpdate.getLimit() == null) {
addViolation(visitor, "update alway true condition not allow", x);
addViolation(visitor, "update none condition not allow", x);
return;
}
} else {
addViolation(visitor, "update alway true condition not allow", x);
addViolation(visitor, "update none condition not allow", x);
return;
}
}
src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java
+1 -4
View File
@@ -22,11 +22,8 @@ public class IllegalSQLObjectViolation implements Violation {
private String message;
private String sqlPart;
public IllegalSQLObjectViolation(){
}
public IllegalSQLObjectViolation(String message, String condition){
this.message = message;
this.sqlPart = condition;
}