This commit is contained in:
温少
2012-03-17 01:39:02 +08:00
parent 86e96ad69f
commit 83806c24b0
5 changed files with 24 additions and 5 deletions
@@ -5,6 +5,8 @@ import static com.alibaba.druid.filter.wall.spi.WallVisitorUtils.loadResource;
import java.util.HashSet;
import java.util.Set;
import com.alibaba.druid.filter.wall.spi.WallVisitorUtils;
public class WallConfig {
private boolean selelctAllow = true;
@@ -170,4 +172,9 @@ public class WallConfig {
public Set<String> getPermitObjects() {
return permitObjects;
}
public boolean containsPermitSchema(String name) {
name = WallVisitorUtils.form(name);
return this.permitSchemas.contains(name);
}
}
@@ -10,7 +10,7 @@ public interface WallVisitor extends SQLASTVisitor {
WallConfig getConfig();
List<Violation> getViolations();
boolean containsPermitTable(String name);
boolean containsPermitObjects(String name);
@@ -165,7 +165,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(SQLMethodInvokeExpr x) {
WallVisitorUtils.check(this, x);
WallVisitorUtils.checkFunction(this, x);
return true;
}
@@ -202,6 +202,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean containsPermitTable(String name) {
if (!config.isTableCheck()) {
return false;
}
name = WallVisitorUtils.form(name);
return config.getPermitTables().contains(name);
}
@@ -72,7 +72,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
@Override
public boolean visit(SQLMethodInvokeExpr x) {
WallVisitorUtils.check(this, x);
WallVisitorUtils.checkFunction(this, x);
return true;
}
@@ -127,6 +127,10 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
@Override
public boolean containsPermitTable(String name) {
if (!config.isTableCheck()) {
return false;
}
name = WallVisitorUtils.form(name);
if (name.startsWith("v$") || name.startsWith("v_$")) {
return true;
@@ -387,7 +387,7 @@ public class WallVisitorUtils {
return false;
}
public static void check(WallVisitor visitor, SQLMethodInvokeExpr x) {
public static void checkFunction(WallVisitor visitor, SQLMethodInvokeExpr x) {
if (x.getOwner() instanceof SQLIdentifierExpr) {
String owner = x.getOwner().toString();
owner = WallVisitorUtils.form(owner);
@@ -395,7 +395,11 @@ public class WallVisitorUtils {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
}
}
if (!visitor.getConfig().isFunctionCheck()) {
return;
}
String methodName = x.getMethodName();
if (visitor.getConfig().getPermitFunctions().contains(methodName.toLowerCase())) {