Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve wall filter

Browse Source
This commit is contained in:
wenshao
2013-04-10 02:56:01 +08:00
parent f1caa4930d
commit 7d80ffd7a7
10 changed files with 177 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/Violation.java
+3
View File
@@ -16,6 +16,9 @@
package com.alibaba.druid.wall;
public interface Violation {
int getErrorCode();
String getMessage();
String toString();
src/main/java/com/alibaba/druid/wall/WallProvider.java
+3 -2
View File
@@ -37,6 +37,7 @@ import com.alibaba.druid.sql.parser.Token;
import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
import com.alibaba.druid.util.LRUCache;
import com.alibaba.druid.wall.spi.WallVisitorUtils;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
import com.alibaba.druid.wall.violation.SyntaxErrorViolation;
@@ -431,7 +432,7 @@ public abstract class WallProvider {
final Token lastToken = parser.getLexer().token();
if (lastToken != Token.EOF) {
violations.add(new IllegalSQLObjectViolation("not terminal sql, token " + lastToken, sql));
violations.add(new IllegalSQLObjectViolation(ErrorCode.SYNTAX_ERROR, "not terminal sql, token " + lastToken, sql));
}
} catch (NotAllowCommentException e) {
violations.add(new SyntaxErrorViolation(e, sql));
@@ -447,7 +448,7 @@ public abstract class WallProvider {
}
if (statementList.size() > 1 && !config.isMultiStatementAllow()) {
violations.add(new IllegalSQLObjectViolation("multi-statement not allow", sql));
violations.add(new IllegalSQLObjectViolation(ErrorCode.MULTI_STATEMENT, "multi-statement not allow", sql));
}
WallVisitor visitor = createWallVisitor();
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+7 -6
View File
@@ -63,6 +63,7 @@ import com.alibaba.druid.wall.WallContext;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallSqlTableStat;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor {
@@ -164,7 +165,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(SQLSelectStatement x) {
if (!config.isSelelctAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("select not allow", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x)));
return false;
}
@@ -176,7 +177,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
if (x.getRowCount() instanceof SQLNumericLiteralExpr) {
int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue();
if (rowCount == 0 && !provider.getConfig().isLimitZeroAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("limit row 0", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.LIMIT_ZERO, "limit row 0", this.toSQL(x)));
}
}
return true;
@@ -189,14 +190,14 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
String varName = varExpr.getName();
if (varName.equalsIgnoreCase("@@session") || varName.equalsIgnoreCase("@@global")) {
if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) {
violations.add(new IllegalSQLObjectViolation("variable in condition not allow", toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable in condition not allow", toSQL(x)));
return false;
}
if (!checkVar(x.getParent(), x.getName())) {
boolean isTop = WallVisitorUtils.isTopNoneFromSelect(x);
if (!isTop) {
violations.add(new IllegalSQLObjectViolation("variable not allow : " + x.getName(), toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x)));
}
}
return false;
@@ -244,7 +245,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) {
boolean isTop = WallVisitorUtils.isTopNoneFromSelect(x);
if (!isTop) {
violations.add(new IllegalSQLObjectViolation("variable not allow : " + x.getName(), toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x)));
}
}
@@ -271,7 +272,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(MySqlOutFileExpr x) {
if (!config.isSelectIntoOutfileAllow()) {
violations.add(new IllegalSQLObjectViolation("into out file not allow", toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.INTO_OUTFILE, "into out file not allow", toSQL(x)));
}
return true;
src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
+4 -3
View File
@@ -55,6 +55,7 @@ import com.alibaba.druid.wall.Violation;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVisitor {
@@ -88,7 +89,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
String name = x.getName();
name = WallVisitorUtils.form(name);
if (config.isVariantCheck() && config.getDenyVariants().contains(name)) {
getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x)));
getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, toSQL(x)));
}
return true;
}
@@ -180,7 +181,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
@Override
public boolean visit(SQLSelectStatement x) {
if (!config.isSelelctAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("select not allow", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x)));
return false;
}
@@ -209,7 +210,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
@Override
public boolean visit(OracleMultiInsertStatement x) {
if (!config.isInsertAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("insert not allow", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.INSERT_NOT_ALLOW, "insert not allow", this.toSQL(x)));
return false;
}
src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java
+3 -2
View File
@@ -48,6 +48,7 @@ import com.alibaba.druid.wall.Violation;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
@@ -81,7 +82,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
String name = x.getName();
name = WallVisitorUtils.form(name);
if (config.isVariantCheck() && config.getDenyVariants().contains(name)) {
getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x)));
getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, toSQL(x)));
}
return true;
}
@@ -173,7 +174,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
@Override
public boolean visit(SQLSelectStatement x) {
if (!config.isSelelctAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("selelct not allow", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", this.toSQL(x)));
return false;
}
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+15 -9
View File
@@ -51,6 +51,7 @@ import com.alibaba.druid.wall.Violation;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements WallVisitor, SQLServerASTVisitor {
@@ -100,7 +101,8 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
String name = x.getName();
name = WallVisitorUtils.form(name);
if (config.isVariantCheck() && config.getDenyVariants().contains(name)) {
getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x)));
getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name,
toSQL(x)));
}
return true;
}
@@ -170,7 +172,8 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
@Override
public boolean visit(SQLSelectStatement x) {
if (!config.isSelelctAllow()) {
this.getViolations().add(new IllegalSQLObjectViolation("selelct not allow", this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow",
this.toSQL(x)));
return false;
}
@@ -203,7 +206,7 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
}
if (config.isVariantCheck() && varName.startsWith("@@")) {
violations.add(new IllegalSQLObjectViolation("global variable not allow", toSQL(x)));
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "global variable not allow", toSQL(x)));
}
return false;
@@ -212,10 +215,13 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
@Override
public boolean visit(SQLServerObjectReferenceExpr x) {
if (x.getSchema() != null && !provider.checkDenySchema(x.getSchema())) {
this.getViolations().add(new IllegalSQLObjectViolation("schema not allow : " + x.getSchema(), this.toSQL(x)));
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SCHEMA_DENY, "schema not allow : "
+ x.getSchema(),
this.toSQL(x)));
}
if (x.getDatabase() != null && !provider.checkDenySchema(x.getDatabase())) {
this.getViolations().add(new IllegalSQLObjectViolation("schema not allow : " + x.getDatabase(),
this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SCHEMA_DENY, "schema not allow : "
+ x.getDatabase(),
this.toSQL(x)));
}
return true;
@@ -248,22 +254,22 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
WallVisitorUtils.check(this, x);
return true;
}
@Override
public boolean visit(SQLDropTableStatement x) {
WallVisitorUtils.check(this, x);
return true;
}
@Override
public boolean visit(SQLSetStatement x) {
return false;
}
public boolean visit(MySqlReplaceStatement x) {
return true;
}
@Override
public boolean visit(SQLCallStatement x) {
return false;
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+57 -38
View File
@@ -90,6 +90,7 @@ import com.alibaba.druid.wall.WallContext;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallSqlTableStat;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class WallVisitorUtils {
@@ -153,7 +154,7 @@ public class WallVisitorUtils {
SQLTableSource from = queryBlock.getFrom();
if (from instanceof SQLExprTableSource) {
addViolation(visitor, "'SELECT *' not allow", x);
addViolation(visitor, ErrorCode.SELECT_NOT_ALLOW, "'SELECT *' not allow", x);
}
}
}
@@ -166,7 +167,7 @@ public class WallVisitorUtils {
checkReadOnly(visitor, x.getTableSource());
if (!visitor.getConfig().isInsertAllow()) {
addViolation(visitor, "insert not allow", x);
addViolation(visitor, ErrorCode.INSERT_NOT_ALLOW, "insert not allow", x);
}
}
@@ -180,7 +181,7 @@ public class WallVisitorUtils {
}
if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) {
addViolation(visitor, "select into not allow", x);
addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x);
return;
}
@@ -208,7 +209,7 @@ public class WallVisitorUtils {
}
if ((!isFirst(where)) && !isSimpleConstExpr) {
addViolation(visitor, "select alway true condition not allow", x);
addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x);
}
}
@@ -222,7 +223,7 @@ public class WallVisitorUtils {
}
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
addViolation(visitor, "having alway true condition not allow", x);
addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x);
}
}
@@ -231,17 +232,17 @@ public class WallVisitorUtils {
WallConfig config = visitor.getConfig();
if (!config.isDeleteAllow()) {
addViolation(visitor, "delete not allow", x);
addViolation(visitor, ErrorCode.INSERT_NOT_ALLOW, "delete not allow", x);
return;
}
if (x.getWhere() == null && config.isDeleteWhereNoneCheck()) {
addViolation(visitor, "delete none condition not allow", x);
addViolation(visitor, ErrorCode.NONE_CONDITION, "delete none condition not allow", x);
return;
}
if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), config.isDeleteWhereAlwayTrueCheck())) {
addViolation(visitor, "delete alway true condition not allow", x);
addViolation(visitor, ErrorCode.ALWAY_TRUE, "delete alway true condition not allow", x);
return;
}
@@ -259,7 +260,7 @@ public class WallVisitorUtils {
x.accept(exportParameterVisitor);
if (exportParameterVisitor.getParameters().size() > 0) {
addViolation(visitor, "sql must parameterized", x);
addViolation(visitor, ErrorCode.NOT_PARAMETERIZED, "sql must parameterized", x);
return;
}
}
@@ -410,7 +411,7 @@ public class WallVisitorUtils {
boolean readOnlyValid = visitor.getProvider().checkReadOnlyTable(tableName);
if (!readOnlyValid) {
addViolation(visitor, "table readonly : " + tableName, tableSource);
addViolation(visitor, ErrorCode.READ_ONLY, "table readonly : " + tableName, tableSource);
}
} else if (tableSource instanceof SQLJoinTableSource) {
SQLJoinTableSource join = (SQLJoinTableSource) tableSource;
@@ -425,7 +426,7 @@ public class WallVisitorUtils {
WallConfig config = visitor.getConfig();
if (!config.isUpdateAllow()) {
addViolation(visitor, "update not allow", x);
addViolation(visitor, ErrorCode.UPDATE_NOT_ALLOW, "update not allow", x);
return;
}
@@ -433,18 +434,18 @@ public class WallVisitorUtils {
if (x instanceof MySqlUpdateStatement) {
MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x;
if (mysqlUpdate.getLimit() == null) {
addViolation(visitor, "update none condition not allow", x);
addViolation(visitor, ErrorCode.NONE_CONDITION, "update none condition not allow", x);
return;
}
} else {
addViolation(visitor, "update none condition not allow", x);
addViolation(visitor, ErrorCode.NONE_CONDITION, "update none condition not allow", x);
return;
}
}
if (config.isUpdateWhereAlayTrueCheck()) {
if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), true)) {
addViolation(visitor, "update alway true condition not allow", x);
addViolation(visitor, ErrorCode.ALWAY_TRUE, "update alway true condition not allow", x);
return;
}
}
@@ -643,19 +644,19 @@ public class WallVisitorUtils {
final WallConditionContext current = wallConditionContextLocal.get();
if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
addViolation(visitor, "part alway true condition not allow", x);
addViolation(visitor, ErrorCode.ALWAY_TRUE, "part alway true condition not allow", x);
}
if (current.hasConstArithmetic() && !visitor.getConfig().isConstArithmeticAllow()) {
addViolation(visitor, "const arithmetic not allow", x);
addViolation(visitor, ErrorCode.CONST_ARITHMETIC, "const arithmetic not allow", x);
}
if (current.hasXor() && !visitor.getConfig().isConditionOpXorAllow()) {
addViolation(visitor, "xor not allow", x);
addViolation(visitor, ErrorCode.XOR, "xor not allow", x);
}
if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwseAllow()) {
addViolation(visitor, "bitwise operator not allow", x);
addViolation(visitor, ErrorCode.BITWISE, "bitwise operator not allow", x);
}
return value;
@@ -841,7 +842,7 @@ public class WallVisitorUtils {
}
}
addViolation(visitor, "deny function : " + methodName, x);
addViolation(visitor, ErrorCode.FUNCTION_DENY, "deny function : " + methodName, x);
}
}
@@ -909,13 +910,13 @@ public class WallVisitorUtils {
boolean topSelectStatement = isTopSelectStatement(x);
if (!topSelectStatement) {
addViolation(visitor, "deny schema : " + owner, x);
addViolation(visitor, ErrorCode.SCHEMA_DENY, "deny schema : " + owner, x);
}
return true;
}
if (visitor.getConfig().isDenyObjects(owner)) {
addViolation(visitor, "deny object : " + owner, x);
addViolation(visitor, ErrorCode.OBJECT_DENY, "deny object : " + owner, x);
return true;
}
}
@@ -1001,8 +1002,8 @@ public class WallVisitorUtils {
if (isTopNoneFrom) {
return false;
}
addViolation(visitor, "deny table : " + tableName, x);
addViolation(visitor, ErrorCode.TABLE_DENY, "deny table : " + tableName, x);
return false;
}
}
@@ -1010,18 +1011,18 @@ public class WallVisitorUtils {
return true;
}
private static void addViolation(WallVisitor visitor, String message, SQLObject x) {
visitor.addViolation(new IllegalSQLObjectViolation(message, visitor.toSQL(x)));
private static void addViolation(WallVisitor visitor, int errorCode, String message, SQLObject x) {
visitor.addViolation(new IllegalSQLObjectViolation(errorCode, message, visitor.toSQL(x)));
}
public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) {
if (x.getOperator() == SQLUnionOperator.MINUS && !visitor.getConfig().isMinusAllow()) {
addViolation(visitor, "minus not allow", x);
addViolation(visitor, ErrorCode.INTERSET_NOT_ALLOW, "minus not allow", x);
return;
}
if (x.getOperator() == SQLUnionOperator.INTERSECT && !visitor.getConfig().isIntersectAllow()) {
addViolation(visitor, "intersect not allow", x);
addViolation(visitor, ErrorCode.INTERSET_NOT_ALLOW, "intersect not allow", x);
return;
}
@@ -1047,7 +1048,7 @@ public class WallVisitorUtils {
return;
}
addViolation(visitor, "union query not contains 'from clause'", x);
addViolation(visitor, ErrorCode.UNION, "union query not contains 'from clause'", x);
}
}
@@ -1176,72 +1177,90 @@ public class WallVisitorUtils {
}
boolean allow = false;
String denyMessage = null;
int errorCode;
String denyMessage;
if (x instanceof SQLInsertStatement) {
allow = true;
allow = config.isInsertAllow();
denyMessage = "insert not allow";
errorCode = ErrorCode.INSERT_NOT_ALLOW;
} else if (x instanceof SQLSelectStatement) {
allow = true;
denyMessage = "select not allow";
errorCode = ErrorCode.SELECT_NOT_ALLOW;
} else if (x instanceof SQLDeleteStatement) {
allow = true;
allow = config.isDeleteAllow();
denyMessage = "delete not allow";
errorCode = ErrorCode.DELETE_NOT_ALLOW;
} else if (x instanceof SQLUpdateStatement) {
allow = true;
allow = config.isUpdateAllow();
denyMessage = "update not allow";
errorCode = ErrorCode.UPDATE_NOT_ALLOW;
} else if (x instanceof OracleMultiInsertStatement) {
allow = true;
denyMessage = "multi-insert not allow";
errorCode = ErrorCode.INSERT_NOT_ALLOW;
} else if (x instanceof OracleMergeStatement) {
allow = true;
allow = config.isMergeAllow();
denyMessage = "merge not allow";
errorCode = ErrorCode.MERGE_NOT_ALLOW;
} else if (x instanceof SQLCallStatement) {
allow = true;
allow = config.isCallAllow();
denyMessage = "call not allow";
errorCode = ErrorCode.CALL_NOT_ALLOW;
} else if (x instanceof SQLTruncateStatement) {
allow = config.isTruncateAllow();
denyMessage = "truncate not allow";
errorCode = ErrorCode.TRUNCATE_NOT_ALLOW;
} else if (x instanceof SQLCreateTableStatement) {
allow = config.isCreateTableAllow();
denyMessage = "create table not allow";
errorCode = ErrorCode.CREATE_TABLE_NOT_ALLOW;
} else if (x instanceof SQLAlterTableStatement) {
allow = config.isAlterTableAllow();
denyMessage = "alter table not allow";
errorCode = ErrorCode.ALTER_TABLE_NOT_ALLOW;
} else if (x instanceof SQLDropTableStatement) {
allow = config.isDropTableAllow();
denyMessage = "drop table not allow";
errorCode = ErrorCode.DROP_TABLE_NOT_ALLOW;
} else if (x instanceof MySqlSetCharSetStatement //
|| x instanceof MySqlSetNamesStatement //
|| x instanceof SQLSetStatement) {
allow = config.isSetAllow();
denyMessage = "set not allow";
errorCode = ErrorCode.SET_NOT_ALLOW;
} else if (x instanceof MySqlReplaceStatement) {
allow = config.isReplaceAllow();
denyMessage = "replace not allow";
errorCode = ErrorCode.REPLACE_NOT_ALLOW;
} else if (x instanceof MySqlDescribeStatement) {
allow = config.isDescribeAllow();
denyMessage = "describe not allow";
errorCode = ErrorCode.DESC_NOT_ALLOW;
} else if (x instanceof MySqlShowStatement) {
allow = config.isShowAllow();
denyMessage = "show not allow";
errorCode = ErrorCode.SHOW_NOT_ALLOW;
} else if (x instanceof MySqlCommitStatement) {
allow = config.isCommitAllow();
denyMessage = "show not allow";
errorCode = ErrorCode.COMMIT_NOT_ALLOW;
} else if (x instanceof SQLRollbackStatement) {
allow = config.isRollbackAllow();
denyMessage = "show not allow";
errorCode = ErrorCode.ROLLBACK_NOT_ALLOW;
} else if (x instanceof SQLUseStatement) {
allow = config.isUseAllow();
denyMessage = "show not allow";
errorCode = ErrorCode.USE_NOT_ALLOW;
} else {
allow = config.isNoneBaseStatementAllow();
errorCode = ErrorCode.NONE_BASE_STATEMENT_NOT_ALLOW;
denyMessage = x.getClass() + " not allow";
}
if (!allow) {
if (denyMessage == null) {
denyMessage = x.getClass() + " not allow";
}
addViolation(visitor, denyMessage, x);
addViolation(visitor, errorCode, denyMessage, x);
}
}
}
src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java
+72
View File
@@ -0,0 +1,72 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.wall.violation;
public interface ErrorCode {
public final static int SYNTAX_ERROR = 1001;
public final static int SELECT_NOT_ALLOW = 1002;
public final static int SELECT_INTO_NOT_ALLOW = 1003;
public final static int INSERT_NOT_ALLOW = 1004;
public final static int DELETE_NOT_ALLOW = 1005;
public final static int UPDATE_NOT_ALLOW = 1006;
public final static int MINUS_NOT_ALLOW = 1007;
public final static int INTERSET_NOT_ALLOW = 1008;
public final static int MERGE_NOT_ALLOW = 1009;
public final static int REPLACE_NOT_ALLOW = 1010;
public final static int CALL_NOT_ALLOW = 1300;
public final static int COMMIT_NOT_ALLOW = 1301;
public final static int ROLLBACK_NOT_ALLOW = 1302;
public final static int SET_NOT_ALLOW = 1200;
public final static int DESC_NOT_ALLOW = 1201;
public final static int SHOW_NOT_ALLOW = 1202;
public final static int USE_NOT_ALLOW = 1203;
public final static int NONE_BASE_STATEMENT_NOT_ALLOW = 1999;
public final static int TRUNCATE_NOT_ALLOW = 1100;
public final static int CREATE_TABLE_NOT_ALLOW = 1101;
public final static int ALTER_TABLE_NOT_ALLOW = 1102;
public final static int DROP_TABLE_NOT_ALLOW = 1103;
public final static int COMMENT_STATEMENT_NOT_ALLOW = 1104;
public final static int LIMIT_ZERO = 2200;
public final static int MULTI_STATEMENT = 2201;
public final static int FUNCTION_DENY = 2001;
public final static int SCHEMA_DENY = 2002;
public final static int VARIANT_DENY = 2003;
public final static int TABLE_DENY = 2004;
public final static int OBJECT_DENY = 2005;
public final static int ALWAY_TRUE = 2100;
public final static int CONST_ARITHMETIC = 2101;
public final static int XOR = 2102;
public final static int BITWISE = 2103;
public final static int NONE_CONDITION = 1200;
public final static int NOT_PARAMETERIZED = 2200;
public final static int MULTI_TENANT = 2201;
public final static int INTO_OUTFILE = 3000;
public final static int READ_ONLY = 4000;
public final static int UNION = 5000;
public final static int OTHER = 9999;
}
src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java
+8 -10
View File
@@ -19,10 +19,12 @@ import com.alibaba.druid.wall.Violation;
public class IllegalSQLObjectViolation implements Violation {
private String message;
private String sqlPart;
private final String message;
private final String sqlPart;
private final int errorCode;
public IllegalSQLObjectViolation(String message, String condition){
public IllegalSQLObjectViolation(int errorCode, String message, String condition){
this.errorCode = errorCode;
this.message = message;
this.sqlPart = condition;
}
@@ -31,10 +33,6 @@ public class IllegalSQLObjectViolation implements Violation {
return sqlPart;
}
public void setSqlPart(String sqlPart) {
this.sqlPart = sqlPart;
}
public String toString() {
return this.sqlPart;
}
@@ -44,9 +42,9 @@ public class IllegalSQLObjectViolation implements Violation {
return message;
}
public void setMessage(String message) {
this.message = message;
@Override
public int getErrorCode() {
return errorCode;
}
src/main/java/com/alibaba/druid/wall/violation/SyntaxErrorViolation.java
+5
View File
@@ -48,4 +48,9 @@ public class SyntaxErrorViolation implements Violation {
return exception.getMessage();
}
@Override
public int getErrorCode() {
return ErrorCode.SYNTAX_ERROR;
}
}