From 7d80ffd7a77be1135581c66db3e44a9f6f60bcef Mon Sep 17 00:00:00 2001 From: wenshao Date: Wed, 10 Apr 2013 02:56:01 +0800 Subject: [PATCH] improve wall filter --- .../com/alibaba/druid/wall/Violation.java | 3 + .../com/alibaba/druid/wall/WallProvider.java | 5 +- .../druid/wall/spi/MySqlWallVisitor.java | 13 +-- .../druid/wall/spi/OracleWallVisitor.java | 7 +- .../alibaba/druid/wall/spi/PGWallVisitor.java | 5 +- .../druid/wall/spi/SQLServerWallVisitor.java | 24 +++-- .../druid/wall/spi/WallVisitorUtils.java | 95 +++++++++++-------- .../druid/wall/violation/ErrorCode.java | 72 ++++++++++++++ .../violation/IllegalSQLObjectViolation.java | 18 ++-- .../wall/violation/SyntaxErrorViolation.java | 5 + 10 files changed, 177 insertions(+), 70 deletions(-) create mode 100644 src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java diff --git a/src/main/java/com/alibaba/druid/wall/Violation.java b/src/main/java/com/alibaba/druid/wall/Violation.java index 07cd139589..103200e277 100644 --- a/src/main/java/com/alibaba/druid/wall/Violation.java +++ b/src/main/java/com/alibaba/druid/wall/Violation.java @@ -16,6 +16,9 @@ package com.alibaba.druid.wall; public interface Violation { + + int getErrorCode(); + String getMessage(); String toString(); diff --git a/src/main/java/com/alibaba/druid/wall/WallProvider.java b/src/main/java/com/alibaba/druid/wall/WallProvider.java index 1405ae8cdf..4544def8af 100644 --- a/src/main/java/com/alibaba/druid/wall/WallProvider.java +++ b/src/main/java/com/alibaba/druid/wall/WallProvider.java @@ -37,6 +37,7 @@ import com.alibaba.druid.sql.parser.Token; import com.alibaba.druid.sql.visitor.ExportParameterVisitor; import com.alibaba.druid.util.LRUCache; import com.alibaba.druid.wall.spi.WallVisitorUtils; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; import com.alibaba.druid.wall.violation.SyntaxErrorViolation; @@ -431,7 +432,7 @@ public abstract class WallProvider { final Token lastToken = parser.getLexer().token(); if (lastToken != Token.EOF) { - violations.add(new IllegalSQLObjectViolation("not terminal sql, token " + lastToken, sql)); + violations.add(new IllegalSQLObjectViolation(ErrorCode.SYNTAX_ERROR, "not terminal sql, token " + lastToken, sql)); } } catch (NotAllowCommentException e) { violations.add(new SyntaxErrorViolation(e, sql)); @@ -447,7 +448,7 @@ public abstract class WallProvider { } if (statementList.size() > 1 && !config.isMultiStatementAllow()) { - violations.add(new IllegalSQLObjectViolation("multi-statement not allow", sql)); + violations.add(new IllegalSQLObjectViolation(ErrorCode.MULTI_STATEMENT, "multi-statement not allow", sql)); } WallVisitor visitor = createWallVisitor(); diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 5afedb8f98..87b1a1d87a 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -63,6 +63,7 @@ import com.alibaba.druid.wall.WallContext; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallSqlTableStat; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor { @@ -164,7 +165,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(SQLSelectStatement x) { if (!config.isSelelctAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("select not allow", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x))); return false; } @@ -176,7 +177,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi if (x.getRowCount() instanceof SQLNumericLiteralExpr) { int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue(); if (rowCount == 0 && !provider.getConfig().isLimitZeroAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("limit row 0", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.LIMIT_ZERO, "limit row 0", this.toSQL(x))); } } return true; @@ -189,14 +190,14 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi String varName = varExpr.getName(); if (varName.equalsIgnoreCase("@@session") || varName.equalsIgnoreCase("@@global")) { if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) { - violations.add(new IllegalSQLObjectViolation("variable in condition not allow", toSQL(x))); + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable in condition not allow", toSQL(x))); return false; } if (!checkVar(x.getParent(), x.getName())) { boolean isTop = WallVisitorUtils.isTopNoneFromSelect(x); if (!isTop) { - violations.add(new IllegalSQLObjectViolation("variable not allow : " + x.getName(), toSQL(x))); + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x))); } } return false; @@ -244,7 +245,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) { boolean isTop = WallVisitorUtils.isTopNoneFromSelect(x); if (!isTop) { - violations.add(new IllegalSQLObjectViolation("variable not allow : " + x.getName(), toSQL(x))); + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x))); } } @@ -271,7 +272,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(MySqlOutFileExpr x) { if (!config.isSelectIntoOutfileAllow()) { - violations.add(new IllegalSQLObjectViolation("into out file not allow", toSQL(x))); + violations.add(new IllegalSQLObjectViolation(ErrorCode.INTO_OUTFILE, "into out file not allow", toSQL(x))); } return true; diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java index 18f0f487f0..3ec1bb7bfc 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java @@ -55,6 +55,7 @@ import com.alibaba.druid.wall.Violation; import com.alibaba.druid.wall.WallConfig; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVisitor { @@ -88,7 +89,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi String name = x.getName(); name = WallVisitorUtils.form(name); if (config.isVariantCheck() && config.getDenyVariants().contains(name)) { - getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x))); + getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, toSQL(x))); } return true; } @@ -180,7 +181,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi @Override public boolean visit(SQLSelectStatement x) { if (!config.isSelelctAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("select not allow", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", this.toSQL(x))); return false; } @@ -209,7 +210,7 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi @Override public boolean visit(OracleMultiInsertStatement x) { if (!config.isInsertAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("insert not allow", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.INSERT_NOT_ALLOW, "insert not allow", this.toSQL(x))); return false; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java index a3160f3479..0fa2c17cd8 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java @@ -48,6 +48,7 @@ import com.alibaba.druid.wall.Violation; import com.alibaba.druid.wall.WallConfig; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { @@ -81,7 +82,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { String name = x.getName(); name = WallVisitorUtils.form(name); if (config.isVariantCheck() && config.getDenyVariants().contains(name)) { - getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x))); + getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, toSQL(x))); } return true; } @@ -173,7 +174,7 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { @Override public boolean visit(SQLSelectStatement x) { if (!config.isSelelctAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("selelct not allow", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", this.toSQL(x))); return false; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index cf52e9868f..e7e91a06ed 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -51,6 +51,7 @@ import com.alibaba.druid.wall.Violation; import com.alibaba.druid.wall.WallConfig; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements WallVisitor, SQLServerASTVisitor { @@ -100,7 +101,8 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements String name = x.getName(); name = WallVisitorUtils.form(name); if (config.isVariantCheck() && config.getDenyVariants().contains(name)) { - getViolations().add(new IllegalSQLObjectViolation("variable not allow : " + name, toSQL(x))); + getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, + toSQL(x))); } return true; } @@ -170,7 +172,8 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements @Override public boolean visit(SQLSelectStatement x) { if (!config.isSelelctAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation("selelct not allow", this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "selelct not allow", + this.toSQL(x))); return false; } @@ -203,7 +206,7 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements } if (config.isVariantCheck() && varName.startsWith("@@")) { - violations.add(new IllegalSQLObjectViolation("global variable not allow", toSQL(x))); + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "global variable not allow", toSQL(x))); } return false; @@ -212,10 +215,13 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements @Override public boolean visit(SQLServerObjectReferenceExpr x) { if (x.getSchema() != null && !provider.checkDenySchema(x.getSchema())) { - this.getViolations().add(new IllegalSQLObjectViolation("schema not allow : " + x.getSchema(), this.toSQL(x))); + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SCHEMA_DENY, "schema not allow : " + + x.getSchema(), + this.toSQL(x))); } if (x.getDatabase() != null && !provider.checkDenySchema(x.getDatabase())) { - this.getViolations().add(new IllegalSQLObjectViolation("schema not allow : " + x.getDatabase(), + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SCHEMA_DENY, "schema not allow : " + + x.getDatabase(), this.toSQL(x))); } return true; @@ -248,22 +254,22 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements WallVisitorUtils.check(this, x); return true; } - + @Override public boolean visit(SQLDropTableStatement x) { WallVisitorUtils.check(this, x); return true; } - + @Override public boolean visit(SQLSetStatement x) { return false; } - + public boolean visit(MySqlReplaceStatement x) { return true; } - + @Override public boolean visit(SQLCallStatement x) { return false; diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 1ceaf901f5..8e5195e51c 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -90,6 +90,7 @@ import com.alibaba.druid.wall.WallContext; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallSqlTableStat; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class WallVisitorUtils { @@ -153,7 +154,7 @@ public class WallVisitorUtils { SQLTableSource from = queryBlock.getFrom(); if (from instanceof SQLExprTableSource) { - addViolation(visitor, "'SELECT *' not allow", x); + addViolation(visitor, ErrorCode.SELECT_NOT_ALLOW, "'SELECT *' not allow", x); } } } @@ -166,7 +167,7 @@ public class WallVisitorUtils { checkReadOnly(visitor, x.getTableSource()); if (!visitor.getConfig().isInsertAllow()) { - addViolation(visitor, "insert not allow", x); + addViolation(visitor, ErrorCode.INSERT_NOT_ALLOW, "insert not allow", x); } } @@ -180,7 +181,7 @@ public class WallVisitorUtils { } if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) { - addViolation(visitor, "select into not allow", x); + addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x); return; } @@ -208,7 +209,7 @@ public class WallVisitorUtils { } if ((!isFirst(where)) && !isSimpleConstExpr) { - addViolation(visitor, "select alway true condition not allow", x); + addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x); } } @@ -222,7 +223,7 @@ public class WallVisitorUtils { } if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { - addViolation(visitor, "having alway true condition not allow", x); + addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x); } } @@ -231,17 +232,17 @@ public class WallVisitorUtils { WallConfig config = visitor.getConfig(); if (!config.isDeleteAllow()) { - addViolation(visitor, "delete not allow", x); + addViolation(visitor, ErrorCode.INSERT_NOT_ALLOW, "delete not allow", x); return; } if (x.getWhere() == null && config.isDeleteWhereNoneCheck()) { - addViolation(visitor, "delete none condition not allow", x); + addViolation(visitor, ErrorCode.NONE_CONDITION, "delete none condition not allow", x); return; } if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), config.isDeleteWhereAlwayTrueCheck())) { - addViolation(visitor, "delete alway true condition not allow", x); + addViolation(visitor, ErrorCode.ALWAY_TRUE, "delete alway true condition not allow", x); return; } @@ -259,7 +260,7 @@ public class WallVisitorUtils { x.accept(exportParameterVisitor); if (exportParameterVisitor.getParameters().size() > 0) { - addViolation(visitor, "sql must parameterized", x); + addViolation(visitor, ErrorCode.NOT_PARAMETERIZED, "sql must parameterized", x); return; } } @@ -410,7 +411,7 @@ public class WallVisitorUtils { boolean readOnlyValid = visitor.getProvider().checkReadOnlyTable(tableName); if (!readOnlyValid) { - addViolation(visitor, "table readonly : " + tableName, tableSource); + addViolation(visitor, ErrorCode.READ_ONLY, "table readonly : " + tableName, tableSource); } } else if (tableSource instanceof SQLJoinTableSource) { SQLJoinTableSource join = (SQLJoinTableSource) tableSource; @@ -425,7 +426,7 @@ public class WallVisitorUtils { WallConfig config = visitor.getConfig(); if (!config.isUpdateAllow()) { - addViolation(visitor, "update not allow", x); + addViolation(visitor, ErrorCode.UPDATE_NOT_ALLOW, "update not allow", x); return; } @@ -433,18 +434,18 @@ public class WallVisitorUtils { if (x instanceof MySqlUpdateStatement) { MySqlUpdateStatement mysqlUpdate = (MySqlUpdateStatement) x; if (mysqlUpdate.getLimit() == null) { - addViolation(visitor, "update none condition not allow", x); + addViolation(visitor, ErrorCode.NONE_CONDITION, "update none condition not allow", x); return; } } else { - addViolation(visitor, "update none condition not allow", x); + addViolation(visitor, ErrorCode.NONE_CONDITION, "update none condition not allow", x); return; } } if (config.isUpdateWhereAlayTrueCheck()) { if (Boolean.TRUE == getConditionValue(visitor, x.getWhere(), true)) { - addViolation(visitor, "update alway true condition not allow", x); + addViolation(visitor, ErrorCode.ALWAY_TRUE, "update alway true condition not allow", x); return; } } @@ -643,19 +644,19 @@ public class WallVisitorUtils { final WallConditionContext current = wallConditionContextLocal.get(); if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { - addViolation(visitor, "part alway true condition not allow", x); + addViolation(visitor, ErrorCode.ALWAY_TRUE, "part alway true condition not allow", x); } if (current.hasConstArithmetic() && !visitor.getConfig().isConstArithmeticAllow()) { - addViolation(visitor, "const arithmetic not allow", x); + addViolation(visitor, ErrorCode.CONST_ARITHMETIC, "const arithmetic not allow", x); } if (current.hasXor() && !visitor.getConfig().isConditionOpXorAllow()) { - addViolation(visitor, "xor not allow", x); + addViolation(visitor, ErrorCode.XOR, "xor not allow", x); } if (current.hasBitwise() && !visitor.getConfig().isConditionOpBitwseAllow()) { - addViolation(visitor, "bitwise operator not allow", x); + addViolation(visitor, ErrorCode.BITWISE, "bitwise operator not allow", x); } return value; @@ -841,7 +842,7 @@ public class WallVisitorUtils { } } - addViolation(visitor, "deny function : " + methodName, x); + addViolation(visitor, ErrorCode.FUNCTION_DENY, "deny function : " + methodName, x); } } @@ -909,13 +910,13 @@ public class WallVisitorUtils { boolean topSelectStatement = isTopSelectStatement(x); if (!topSelectStatement) { - addViolation(visitor, "deny schema : " + owner, x); + addViolation(visitor, ErrorCode.SCHEMA_DENY, "deny schema : " + owner, x); } return true; } if (visitor.getConfig().isDenyObjects(owner)) { - addViolation(visitor, "deny object : " + owner, x); + addViolation(visitor, ErrorCode.OBJECT_DENY, "deny object : " + owner, x); return true; } } @@ -1001,8 +1002,8 @@ public class WallVisitorUtils { if (isTopNoneFrom) { return false; } - - addViolation(visitor, "deny table : " + tableName, x); + + addViolation(visitor, ErrorCode.TABLE_DENY, "deny table : " + tableName, x); return false; } } @@ -1010,18 +1011,18 @@ public class WallVisitorUtils { return true; } - private static void addViolation(WallVisitor visitor, String message, SQLObject x) { - visitor.addViolation(new IllegalSQLObjectViolation(message, visitor.toSQL(x))); + private static void addViolation(WallVisitor visitor, int errorCode, String message, SQLObject x) { + visitor.addViolation(new IllegalSQLObjectViolation(errorCode, message, visitor.toSQL(x))); } public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) { if (x.getOperator() == SQLUnionOperator.MINUS && !visitor.getConfig().isMinusAllow()) { - addViolation(visitor, "minus not allow", x); + addViolation(visitor, ErrorCode.INTERSET_NOT_ALLOW, "minus not allow", x); return; } if (x.getOperator() == SQLUnionOperator.INTERSECT && !visitor.getConfig().isIntersectAllow()) { - addViolation(visitor, "intersect not allow", x); + addViolation(visitor, ErrorCode.INTERSET_NOT_ALLOW, "intersect not allow", x); return; } @@ -1047,7 +1048,7 @@ public class WallVisitorUtils { return; } - addViolation(visitor, "union query not contains 'from clause'", x); + addViolation(visitor, ErrorCode.UNION, "union query not contains 'from clause'", x); } } @@ -1176,72 +1177,90 @@ public class WallVisitorUtils { } boolean allow = false; - String denyMessage = null; + int errorCode; + String denyMessage; if (x instanceof SQLInsertStatement) { - allow = true; + allow = config.isInsertAllow(); denyMessage = "insert not allow"; + errorCode = ErrorCode.INSERT_NOT_ALLOW; } else if (x instanceof SQLSelectStatement) { allow = true; denyMessage = "select not allow"; + errorCode = ErrorCode.SELECT_NOT_ALLOW; } else if (x instanceof SQLDeleteStatement) { - allow = true; + allow = config.isDeleteAllow(); denyMessage = "delete not allow"; + errorCode = ErrorCode.DELETE_NOT_ALLOW; } else if (x instanceof SQLUpdateStatement) { - allow = true; + allow = config.isUpdateAllow(); denyMessage = "update not allow"; + errorCode = ErrorCode.UPDATE_NOT_ALLOW; } else if (x instanceof OracleMultiInsertStatement) { allow = true; denyMessage = "multi-insert not allow"; + errorCode = ErrorCode.INSERT_NOT_ALLOW; } else if (x instanceof OracleMergeStatement) { - allow = true; + allow = config.isMergeAllow(); denyMessage = "merge not allow"; + errorCode = ErrorCode.MERGE_NOT_ALLOW; } else if (x instanceof SQLCallStatement) { - allow = true; + allow = config.isCallAllow(); denyMessage = "call not allow"; + errorCode = ErrorCode.CALL_NOT_ALLOW; } else if (x instanceof SQLTruncateStatement) { allow = config.isTruncateAllow(); denyMessage = "truncate not allow"; + errorCode = ErrorCode.TRUNCATE_NOT_ALLOW; } else if (x instanceof SQLCreateTableStatement) { allow = config.isCreateTableAllow(); denyMessage = "create table not allow"; + errorCode = ErrorCode.CREATE_TABLE_NOT_ALLOW; } else if (x instanceof SQLAlterTableStatement) { allow = config.isAlterTableAllow(); denyMessage = "alter table not allow"; + errorCode = ErrorCode.ALTER_TABLE_NOT_ALLOW; } else if (x instanceof SQLDropTableStatement) { allow = config.isDropTableAllow(); denyMessage = "drop table not allow"; + errorCode = ErrorCode.DROP_TABLE_NOT_ALLOW; } else if (x instanceof MySqlSetCharSetStatement // || x instanceof MySqlSetNamesStatement // || x instanceof SQLSetStatement) { allow = config.isSetAllow(); denyMessage = "set not allow"; + errorCode = ErrorCode.SET_NOT_ALLOW; } else if (x instanceof MySqlReplaceStatement) { allow = config.isReplaceAllow(); denyMessage = "replace not allow"; + errorCode = ErrorCode.REPLACE_NOT_ALLOW; } else if (x instanceof MySqlDescribeStatement) { allow = config.isDescribeAllow(); denyMessage = "describe not allow"; + errorCode = ErrorCode.DESC_NOT_ALLOW; } else if (x instanceof MySqlShowStatement) { allow = config.isShowAllow(); denyMessage = "show not allow"; + errorCode = ErrorCode.SHOW_NOT_ALLOW; } else if (x instanceof MySqlCommitStatement) { allow = config.isCommitAllow(); denyMessage = "show not allow"; + errorCode = ErrorCode.COMMIT_NOT_ALLOW; } else if (x instanceof SQLRollbackStatement) { allow = config.isRollbackAllow(); denyMessage = "show not allow"; + errorCode = ErrorCode.ROLLBACK_NOT_ALLOW; } else if (x instanceof SQLUseStatement) { allow = config.isUseAllow(); denyMessage = "show not allow"; + errorCode = ErrorCode.USE_NOT_ALLOW; } else { allow = config.isNoneBaseStatementAllow(); + errorCode = ErrorCode.NONE_BASE_STATEMENT_NOT_ALLOW; + denyMessage = x.getClass() + " not allow"; } if (!allow) { - if (denyMessage == null) { - denyMessage = x.getClass() + " not allow"; - } - addViolation(visitor, denyMessage, x); + addViolation(visitor, errorCode, denyMessage, x); } } } diff --git a/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java b/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java new file mode 100644 index 0000000000..bb08c0f863 --- /dev/null +++ b/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java @@ -0,0 +1,72 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.wall.violation; + +public interface ErrorCode { + + public final static int SYNTAX_ERROR = 1001; + public final static int SELECT_NOT_ALLOW = 1002; + public final static int SELECT_INTO_NOT_ALLOW = 1003; + public final static int INSERT_NOT_ALLOW = 1004; + public final static int DELETE_NOT_ALLOW = 1005; + public final static int UPDATE_NOT_ALLOW = 1006; + public final static int MINUS_NOT_ALLOW = 1007; + public final static int INTERSET_NOT_ALLOW = 1008; + public final static int MERGE_NOT_ALLOW = 1009; + public final static int REPLACE_NOT_ALLOW = 1010; + + public final static int CALL_NOT_ALLOW = 1300; + public final static int COMMIT_NOT_ALLOW = 1301; + public final static int ROLLBACK_NOT_ALLOW = 1302; + + public final static int SET_NOT_ALLOW = 1200; + public final static int DESC_NOT_ALLOW = 1201; + public final static int SHOW_NOT_ALLOW = 1202; + public final static int USE_NOT_ALLOW = 1203; + + public final static int NONE_BASE_STATEMENT_NOT_ALLOW = 1999; + + public final static int TRUNCATE_NOT_ALLOW = 1100; + public final static int CREATE_TABLE_NOT_ALLOW = 1101; + public final static int ALTER_TABLE_NOT_ALLOW = 1102; + public final static int DROP_TABLE_NOT_ALLOW = 1103; + public final static int COMMENT_STATEMENT_NOT_ALLOW = 1104; + + public final static int LIMIT_ZERO = 2200; + public final static int MULTI_STATEMENT = 2201; + + public final static int FUNCTION_DENY = 2001; + public final static int SCHEMA_DENY = 2002; + public final static int VARIANT_DENY = 2003; + public final static int TABLE_DENY = 2004; + public final static int OBJECT_DENY = 2005; + + public final static int ALWAY_TRUE = 2100; + public final static int CONST_ARITHMETIC = 2101; + public final static int XOR = 2102; + public final static int BITWISE = 2103; + public final static int NONE_CONDITION = 1200; + + public final static int NOT_PARAMETERIZED = 2200; + public final static int MULTI_TENANT = 2201; + + public final static int INTO_OUTFILE = 3000; + + public final static int READ_ONLY = 4000; + public final static int UNION = 5000; + + public final static int OTHER = 9999; +} diff --git a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java index d13ee4e68b..1e03a8745e 100644 --- a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java +++ b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java @@ -19,10 +19,12 @@ import com.alibaba.druid.wall.Violation; public class IllegalSQLObjectViolation implements Violation { - private String message; - private String sqlPart; + private final String message; + private final String sqlPart; + private final int errorCode; - public IllegalSQLObjectViolation(String message, String condition){ + public IllegalSQLObjectViolation(int errorCode, String message, String condition){ + this.errorCode = errorCode; this.message = message; this.sqlPart = condition; } @@ -31,10 +33,6 @@ public class IllegalSQLObjectViolation implements Violation { return sqlPart; } - public void setSqlPart(String sqlPart) { - this.sqlPart = sqlPart; - } - public String toString() { return this.sqlPart; } @@ -44,9 +42,9 @@ public class IllegalSQLObjectViolation implements Violation { return message; } - - public void setMessage(String message) { - this.message = message; + @Override + public int getErrorCode() { + return errorCode; } diff --git a/src/main/java/com/alibaba/druid/wall/violation/SyntaxErrorViolation.java b/src/main/java/com/alibaba/druid/wall/violation/SyntaxErrorViolation.java index 97294b152d..2c33800d7d 100644 --- a/src/main/java/com/alibaba/druid/wall/violation/SyntaxErrorViolation.java +++ b/src/main/java/com/alibaba/druid/wall/violation/SyntaxErrorViolation.java @@ -48,4 +48,9 @@ public class SyntaxErrorViolation implements Violation { return exception.getMessage(); } + + @Override + public int getErrorCode() { + return ErrorCode.SYNTAX_ERROR; + } }