diff --git a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt index f701d3f1dd..ebbdd42dfd 100644 --- a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt @@ -1,4 +1,4 @@ -SYS_CONTEXT -USERENV -SYS_GUID +SYS_CONTEXT +USERENV +SYS_GUID SYS_TYPEID \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt index c4604b68df..60e74475dc 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt @@ -1,3 +1,9 @@ EXECUTE EXEC -sp_executesql \ No newline at end of file +sp_executesql +user_name +is_srvrolemember +system_user +DB_NAME +HOST_NAME +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt index e69de29bb2..fda7909c8f 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt @@ -0,0 +1,2 @@ +user +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt index e69de29bb2..ca291e9654 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt @@ -0,0 +1 @@ +version \ No newline at end of file diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 8423f3b4d3..b30fdca15f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -38,21 +38,38 @@ public class SQLServerWallPermitFunctionTest extends TestCase { public void test01() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name();")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + + public final void test_sp_addsrvrolemenber() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); + } + + public final void test_sp_helpdb() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master")); Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs")); } + public final void test_sp_droplogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + public final void test_sp_addlogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); + } + + public final void test_db_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); + } + + public final void test_host_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); + } + /** * 测试权限结构 * @throws Exception */ - public void test02() throws Exception { + public void test_is_srvrolemember() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);")); @@ -65,4 +82,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); ")); } + public void test_system_user() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java index 2f20d53513..47d2a41d21 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java @@ -19,10 +19,7 @@ public class SQLServerWallPermitTableTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases")); } - public void test02() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); - } - + public void test03() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java index 4174408d55..0bfe7d1048 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java @@ -4,7 +4,9 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; +import junit.framework.Test; import junit.framework.TestCase; +import junit.framework.TestSuite; /** * SQLServerWallTest @@ -45,4 +47,62 @@ public class SQLServerWallTest extends TestCase { } + public static Test suite() { + TestSuite suite = new TestSuite(SQLServerWallTest.class.getName()); + //$JUnit-BEGIN$ + suite.addTestSuite(MySqlWallLimitTest.class); + suite.addTestSuite(MySqlWallLoadDataInfileTest.class); + suite.addTestSuite(MySqlWallPermitFunctionTest.class); + suite.addTestSuite(MySqlWallPermitTableTest.class); + suite.addTestSuite(MySqlWallPermitVariantTest.class); + suite.addTestSuite(MySqlWallTest.class); + suite.addTestSuite(OracleWallPermitFunctionTest.class); + suite.addTestSuite(OracleWallPermitObjectTest.class); + suite.addTestSuite(OracleWallPermitSchemaTest.class); + suite.addTestSuite(OracleWallPermitTableTest.class); + suite.addTestSuite(OracleWallPermitVariantTest.class); + suite.addTestSuite(OracleWallPermitVariantTest2.class); + suite.addTestSuite(OracleWallTest.class); + suite.addTestSuite(SQLServerWallPermitFunctionTest.class); + suite.addTestSuite(SQLServerWallPermitObjectTest.class); + suite.addTestSuite(SQLServerWallPermitSchemaTest.class); + suite.addTestSuite(SQLServerWallPermitTableTest.class); + suite.addTestSuite(SQLServerWallTest.class); + suite.addTestSuite(WallDeleteTest.class); + suite.addTestSuite(WallDeleteWhereTest.class); + suite.addTestSuite(WallDeleteWhereTest1.class); + suite.addTestSuite(WallDropTest.class); + suite.addTestSuite(WallDropTest1.class); + suite.addTestSuite(WallHavingTest.class); + suite.addTestSuite(WallInsertTest.class); + suite.addTestSuite(WallInsertTest2.class); + suite.addTestSuite(WallLineCommentTest.class); + suite.addTestSuite(WallMultiLineCommentTest.class); + suite.addTestSuite(WallMultiStatementTest.class); + suite.addTestSuite(WallReadOnlyTest.class); + suite.addTestSuite(WallSelectIntoTest.class); + suite.addTestSuite(WallSelectIntoTest1.class); + suite.addTestSuite(WallSelectWhereTest.class); + suite.addTestSuite(WallSelectWhereTest0.class); + suite.addTestSuite(WallSelectWhereTest1.class); + suite.addTestSuite(WallSelectWhereTest2.class); + suite.addTestSuite(WallSelectWhereTest3.class); + suite.addTestSuite(WallSelectWhereTest4.class); + suite.addTestSuite(WallSelectWhereTest5.class); + suite.addTestSuite(WallTruncateTest.class); + suite.addTestSuite(WallTruncateTest1.class); + suite.addTestSuite(WallUnionTest.class); + suite.addTestSuite(WallUnionTest2.class); + suite.addTestSuite(WallUnionTest3.class); + suite.addTestSuite(WallUnionTest4.class); + suite.addTestSuite(WallUpdateTest.class); + suite.addTestSuite(WallUpdateTest1.class); + suite.addTestSuite(WallUpdateTest2.class); + suite.addTestSuite(WallUpdateTest3.class); + suite.addTestSuite(WallUpdateTest4.class); + suite.addTestSuite(WallUpdateWhereTest.class); + suite.addTestSuite(WallVisitorUtilsTest.class); + //$JUnit-END$ + return suite; + } } \ No newline at end of file