diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java index 6cf790d56f..c04b8f0ed5 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java @@ -32,11 +32,13 @@ public class WallConfig { private boolean shcemaCheck = true; private boolean tableCheck = true; private boolean functionCheck = true; + private boolean objectCheck = true; + private boolean variantCheck = true; protected final Set permitFunctions = new HashSet(); protected final Set permitTables = new HashSet(); protected final Set permitSchemas = new HashSet(); - protected final Set permitNames = new HashSet(); + protected final Set permitVariants = new HashSet(); protected final Set permitObjects = new HashSet(); private String dir; @@ -73,7 +75,7 @@ public class WallConfig { dir = dir.substring(0, dir.length() - 1); } - loadResource(getPermitNames(), dir + "/permit-name.txt"); + loadResource(getPermitVariants(), dir + "/permit-variant.txt"); loadResource(getPermitSchemas(), dir + "/permit-schema.txt"); loadResource(getPermitFunctions(), dir + "/permit-function.txt"); loadResource(getPermitTables(), dir + "/permit-table.txt"); @@ -216,6 +218,22 @@ public class WallConfig { this.functionCheck = functionCheck; } + public boolean isVariantCheck() { + return variantCheck; + } + + public void setVariantCheck(boolean variantCheck) { + this.variantCheck = variantCheck; + } + + public boolean isObjectCheck() { + return objectCheck; + } + + public void setObjectCheck(boolean objectCheck) { + this.objectCheck = objectCheck; + } + // /////////////////// public Set getPermitFunctions() { @@ -230,8 +248,8 @@ public class WallConfig { return permitSchemas; } - public Set getPermitNames() { - return permitNames; + public Set getPermitVariants() { + return permitVariants; } public Set getPermitObjects() { diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java index 7608428884..fb42d1131c 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java @@ -142,7 +142,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi return false; } - if (varName.startsWith("@@")) { + if (config.isVariantCheck() && varName.startsWith("@@")) { violations.add(new IllegalSQLObjectViolation(toSQL(x))); } @@ -201,7 +201,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi if (!(x instanceof SQLStatement)) { return; } - + if (config.isNoneBaseStatementAllow()) { return; } @@ -213,10 +213,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } else if (x instanceof SQLDeleteStatement) { } else if (x instanceof SQLUpdateStatement) { - + } else if (x instanceof SQLTruncateStatement) { if (!config.isTruncateAllow()) { - violations.add(new IllegalSQLObjectViolation(toSQL(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } } else { violations.add(new IllegalSQLObjectViolation(toSQL(x))); diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java index 118d54de2d..2bc5c39944 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java @@ -51,7 +51,11 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi } public boolean visit(SQLIdentifierExpr x) { - + String name = x.getName(); + name = WallVisitorUtils.form(name); + if (config.isVariantCheck() && config.getPermitVariants().contains(name)) { + getViolations().add(new IllegalSQLObjectViolation(toSQL(x))); + } return true; } diff --git a/src/main/resources/META-INF/druid/wall/oracle/permit-name.txt b/src/main/resources/META-INF/druid/wall/oracle/permit-variant.txt similarity index 100% rename from src/main/resources/META-INF/druid/wall/oracle/permit-name.txt rename to src/main/resources/META-INF/druid/wall/oracle/permit-variant.txt diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java new file mode 100644 index 0000000000..cf0975113d --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java @@ -0,0 +1,30 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景测试访问Oracle系统对象 + * + * @author admin + */ +public class MySqlWallPermitVariantTest extends TestCase { + + public void test_allow() throws Exception { + WallConfig config = new WallConfig(); + config.setVariantCheck(false); + + Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os", config)); + } + + public void test_not_allow() throws Exception { + WallConfig config = new WallConfig(); + config.setVariantCheck(true); + + Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os", config)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest.java new file mode 100644 index 0000000000..73798f8998 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest.java @@ -0,0 +1,26 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景测试访问Oracle系统对象 + * + * @author admin + */ +public class OracleWallPermitVariantTest extends TestCase { + + public void test_permitTable() throws Exception { + WallConfig config = new WallConfig(); + config.setVariantCheck(false); + + Assert.assertTrue(WallUtils.isValidateOracle("select UID from dual", config)); + Assert.assertTrue(WallUtils.isValidateOracle("select USER from dual", config)); + Assert.assertTrue(WallUtils.isValidateOracle("select user from dual", config)); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest2.java new file mode 100644 index 0000000000..9f8c44d9aa --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest2.java @@ -0,0 +1,21 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景测试访问Oracle系统对象 + * + * @author admin + */ +public class OracleWallPermitVariantTest2 extends TestCase { + + public void test_permitTable() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle("select UID from dual")); + Assert.assertFalse(WallUtils.isValidateOracle("select USER from dual")); + } + +} diff --git a/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java b/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java index cfe738d3c1..5558624799 100644 --- a/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java +++ b/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java @@ -34,7 +34,7 @@ public class OnlineOracleTest3 extends TestCase { } public void test_connect() throws Exception { - executeQuery("select * from all_users"); + executeQuery("select UID, USER FROM DUAL"); } public void executeQuery(String sql) throws SQLException {