From 87f6d7c03b9894c79e8a5fb8e0a0d1040455dde4 Mon Sep 17 00:00:00 2001 From: xiusiyan Date: Sun, 18 Mar 2012 21:06:59 +0800 Subject: [PATCH 1/3] refactor --- .../bvt/filter/wall/SQLServerWallTest.java | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java index 4174408d55..0bfe7d1048 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java @@ -4,7 +4,9 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; +import junit.framework.Test; import junit.framework.TestCase; +import junit.framework.TestSuite; /** * SQLServerWallTest @@ -45,4 +47,62 @@ public class SQLServerWallTest extends TestCase { } + public static Test suite() { + TestSuite suite = new TestSuite(SQLServerWallTest.class.getName()); + //$JUnit-BEGIN$ + suite.addTestSuite(MySqlWallLimitTest.class); + suite.addTestSuite(MySqlWallLoadDataInfileTest.class); + suite.addTestSuite(MySqlWallPermitFunctionTest.class); + suite.addTestSuite(MySqlWallPermitTableTest.class); + suite.addTestSuite(MySqlWallPermitVariantTest.class); + suite.addTestSuite(MySqlWallTest.class); + suite.addTestSuite(OracleWallPermitFunctionTest.class); + suite.addTestSuite(OracleWallPermitObjectTest.class); + suite.addTestSuite(OracleWallPermitSchemaTest.class); + suite.addTestSuite(OracleWallPermitTableTest.class); + suite.addTestSuite(OracleWallPermitVariantTest.class); + suite.addTestSuite(OracleWallPermitVariantTest2.class); + suite.addTestSuite(OracleWallTest.class); + suite.addTestSuite(SQLServerWallPermitFunctionTest.class); + suite.addTestSuite(SQLServerWallPermitObjectTest.class); + suite.addTestSuite(SQLServerWallPermitSchemaTest.class); + suite.addTestSuite(SQLServerWallPermitTableTest.class); + suite.addTestSuite(SQLServerWallTest.class); + suite.addTestSuite(WallDeleteTest.class); + suite.addTestSuite(WallDeleteWhereTest.class); + suite.addTestSuite(WallDeleteWhereTest1.class); + suite.addTestSuite(WallDropTest.class); + suite.addTestSuite(WallDropTest1.class); + suite.addTestSuite(WallHavingTest.class); + suite.addTestSuite(WallInsertTest.class); + suite.addTestSuite(WallInsertTest2.class); + suite.addTestSuite(WallLineCommentTest.class); + suite.addTestSuite(WallMultiLineCommentTest.class); + suite.addTestSuite(WallMultiStatementTest.class); + suite.addTestSuite(WallReadOnlyTest.class); + suite.addTestSuite(WallSelectIntoTest.class); + suite.addTestSuite(WallSelectIntoTest1.class); + suite.addTestSuite(WallSelectWhereTest.class); + suite.addTestSuite(WallSelectWhereTest0.class); + suite.addTestSuite(WallSelectWhereTest1.class); + suite.addTestSuite(WallSelectWhereTest2.class); + suite.addTestSuite(WallSelectWhereTest3.class); + suite.addTestSuite(WallSelectWhereTest4.class); + suite.addTestSuite(WallSelectWhereTest5.class); + suite.addTestSuite(WallTruncateTest.class); + suite.addTestSuite(WallTruncateTest1.class); + suite.addTestSuite(WallUnionTest.class); + suite.addTestSuite(WallUnionTest2.class); + suite.addTestSuite(WallUnionTest3.class); + suite.addTestSuite(WallUnionTest4.class); + suite.addTestSuite(WallUpdateTest.class); + suite.addTestSuite(WallUpdateTest1.class); + suite.addTestSuite(WallUpdateTest2.class); + suite.addTestSuite(WallUpdateTest3.class); + suite.addTestSuite(WallUpdateTest4.class); + suite.addTestSuite(WallUpdateWhereTest.class); + suite.addTestSuite(WallVisitorUtilsTest.class); + //$JUnit-END$ + return suite; + } } \ No newline at end of file From 9ffd91524efa5deee15f1c73fc848cc6e0e070cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=B8=A9=E5=B0=91?= Date: Sun, 18 Mar 2012 22:07:04 +0800 Subject: [PATCH 2/3] refactor --- .../com/alibaba/druid/sql/ast/SQLName.java | 2 +- .../druid/sql/ast/expr/SQLIdentifierExpr.java | 4 ++ .../druid/sql/ast/expr/SQLPropertyExpr.java | 4 ++ .../oracle/ast/expr/OracleDbLinkExpr.java | 4 ++ .../expr/SQLServerObjectReferenceExpr.java | 58 +++++++++---------- .../sqlserver/parser/SQLServerExprParser.java | 8 ++- .../druid/wall/spi/SQLServerWallVisitor.java | 9 +++ .../druid/wall/spi/WallVisitorUtils.java | 4 +- 8 files changed, 55 insertions(+), 38 deletions(-) diff --git a/src/main/java/com/alibaba/druid/sql/ast/SQLName.java b/src/main/java/com/alibaba/druid/sql/ast/SQLName.java index 7a317a28ec..c31c094fb2 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/SQLName.java +++ b/src/main/java/com/alibaba/druid/sql/ast/SQLName.java @@ -16,5 +16,5 @@ package com.alibaba.druid.sql.ast; public interface SQLName extends SQLExpr { - + String getSimleName(); } diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLIdentifierExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLIdentifierExpr.java index 7d48d1df17..887b9145f4 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLIdentifierExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLIdentifierExpr.java @@ -33,6 +33,10 @@ public class SQLIdentifierExpr extends SQLExprImpl implements SQLName { this.name = name; } + + public String getSimleName() { + return name; + } public String getName() { return this.name; diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLPropertyExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLPropertyExpr.java index cc70848a9f..baee099885 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLPropertyExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLPropertyExpr.java @@ -36,6 +36,10 @@ public class SQLPropertyExpr extends SQLExprImpl implements SQLName { public SQLPropertyExpr(){ } + + public String getSimleName() { + return name; + } public SQLExpr getOwner() { return this.owner; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/expr/OracleDbLinkExpr.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/expr/OracleDbLinkExpr.java index 69d7768318..9ccc8911a6 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/expr/OracleDbLinkExpr.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/expr/OracleDbLinkExpr.java @@ -30,6 +30,10 @@ public class OracleDbLinkExpr extends SQLExprImpl implements SQLName, OracleExpr public OracleDbLinkExpr(){ } + + public String getSimleName() { + return dbLink; + } public SQLExpr getExpr() { return this.expr; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/ast/expr/SQLServerObjectReferenceExpr.java b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/ast/expr/SQLServerObjectReferenceExpr.java index b8cd6e3477..62114e7e27 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/ast/expr/SQLServerObjectReferenceExpr.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/ast/expr/SQLServerObjectReferenceExpr.java @@ -14,31 +14,39 @@ public class SQLServerObjectReferenceExpr extends SQLServerObjectImpl implements private String server; private String database; private String schema; - private String object; - - public SQLServerObjectReferenceExpr() { - + + public SQLServerObjectReferenceExpr(){ + } - - public SQLServerObjectReferenceExpr(SQLExpr owner, String name) { + + public SQLServerObjectReferenceExpr(SQLExpr owner){ if (owner instanceof SQLIdentifierExpr) { this.database = ((SQLIdentifierExpr) owner).getName(); - this.object = name; } else if (owner instanceof SQLPropertyExpr) { SQLPropertyExpr propExpr = (SQLPropertyExpr) owner; - + this.server = ((SQLIdentifierExpr) propExpr.getOwner()).getName(); this.database = propExpr.getName(); - this.object = name; } else { throw new IllegalArgumentException(owner.toString()); } } + public String getSimleName() { + if (schema != null) { + return schema; + } + + if (database != null) { + return database; + } + return server; + } + @Override public void accept0(SQLServerASTVisitor visitor) { if (visitor.visit(this)) { - + } visitor.endVisit(this); } @@ -47,31 +55,25 @@ public class SQLServerObjectReferenceExpr extends SQLServerObjectImpl implements boolean flag = false; if (server != null) { buf.append(server); - buf.append('.'); flag = true; } + if (flag) { + buf.append('.'); + } if (database != null) { buf.append(database); - buf.append('.'); flag = true; - } else { - if (flag) { - buf.append('.'); - } - } + } + if (flag) { + buf.append('.'); + } + if (schema != null) { buf.append(schema); - buf.append('.'); flag = true; - } else { - if (flag) { - buf.append('.'); - } } - - buf.append(object); } public String getServer() { @@ -98,12 +100,4 @@ public class SQLServerObjectReferenceExpr extends SQLServerObjectImpl implements this.schema = schema; } - public String getObject() { - return object; - } - - public void setObject(String object) { - this.object = object; - } - } diff --git a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerExprParser.java b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerExprParser.java index 278b5b61b1..cf5a73e272 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerExprParser.java @@ -2,6 +2,7 @@ package com.alibaba.druid.sql.dialect.sqlserver.parser; import com.alibaba.druid.sql.ast.SQLExpr; import com.alibaba.druid.sql.ast.SQLName; +import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr; import com.alibaba.druid.sql.parser.Lexer; import com.alibaba.druid.sql.parser.ParserException; @@ -27,15 +28,16 @@ public class SQLServerExprParser extends SQLExprParser { return super.primaryRest(expr); } - public SQLName nameRest(SQLName name) throws ParserException { + public SQLName nameRest(SQLName expr) throws ParserException { if (lexer.token() == Token.DOTDOT) { lexer.nextToken(); String text = lexer.stringVal(); lexer.nextToken(); - name = new SQLServerObjectReferenceExpr(name, text); + SQLServerObjectReferenceExpr owner = new SQLServerObjectReferenceExpr(expr); + expr = new SQLPropertyExpr(owner, text); } - return super.nameRest(name); + return super.nameRest(expr); } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index 21b6a44e84..7b6c13fd1f 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -20,6 +20,7 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; +import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr; import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor; import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitorAdapter; import com.alibaba.druid.wall.IllegalSQLObjectViolation; @@ -178,4 +179,12 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements return true; } + + @Override + public boolean visit(SQLServerObjectReferenceExpr x) { + if (config.isPermitSchema(x.getSchema()) || config.isPermitSchema(x.getDatabase())) { + this.getViolations().add(new IllegalSQLObjectViolation(this.toSQL(x))); + } + return true; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 779fd69d68..5272ac30c4 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -464,8 +464,8 @@ public class WallVisitorUtils { if (expr instanceof SQLPropertyExpr) { SQLPropertyExpr propExpr = (SQLPropertyExpr) expr; - if (propExpr.getOwner() instanceof SQLIdentifierExpr) { - String ownerName = ((SQLIdentifierExpr) propExpr.getOwner()).getName(); + if (propExpr.getOwner() instanceof SQLName) { + String ownerName = ((SQLName) propExpr.getOwner()).getSimleName(); ownerName = form(ownerName); From 4dfa7fb8b62462c87e7b01fe2b91df24c71a9c46 Mon Sep 17 00:00:00 2001 From: xiusiyan Date: Sun, 18 Mar 2012 22:16:05 +0800 Subject: [PATCH 3/3] refactor --- .../druid/wall/oracle/permit-function.txt | 6 ++-- .../druid/wall/sqlserver/permit-function.txt | 8 ++++- .../druid/wall/sqlserver/permit-object.txt | 2 ++ .../druid/wall/sqlserver/permit-variant.txt | 1 + .../wall/SQLServerWallPermitFunctionTest.java | 32 +++++++++++++++---- .../wall/SQLServerWallPermitTableTest.java | 5 +-- 6 files changed, 40 insertions(+), 14 deletions(-) diff --git a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt index f701d3f1dd..ebbdd42dfd 100644 --- a/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/oracle/permit-function.txt @@ -1,4 +1,4 @@ -SYS_CONTEXT -USERENV -SYS_GUID +SYS_CONTEXT +USERENV +SYS_GUID SYS_TYPEID \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt index c4604b68df..60e74475dc 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-function.txt @@ -1,3 +1,9 @@ EXECUTE EXEC -sp_executesql \ No newline at end of file +sp_executesql +user_name +is_srvrolemember +system_user +DB_NAME +HOST_NAME +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt index e69de29bb2..fda7909c8f 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-object.txt @@ -0,0 +1,2 @@ +user +system_user \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt index e69de29bb2..ca291e9654 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/permit-variant.txt @@ -0,0 +1 @@ +version \ No newline at end of file diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 8423f3b4d3..b30fdca15f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -38,21 +38,38 @@ public class SQLServerWallPermitFunctionTest extends TestCase { public void test01() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name();")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + + public final void test_sp_addsrvrolemenber() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin")); + } + + public final void test_sp_helpdb() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb master")); Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_helpdb pubs")); } + public final void test_sp_droplogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_droplogin ‘user’;")); + } + public final void test_sp_addlogin() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("EXEC sp_addlogin ‘user’, ‘pass’; ")); + } + + public final void test_db_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME()")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0); ")); + } + + public final void test_host_name() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME()")); + } + /** * 测试权限结构 * @throws Exception */ - public void test02() throws Exception { + public void test_is_srvrolemember() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’);")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’);")); @@ -65,4 +82,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’); ")); } + public void test_system_user() throws Exception { + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java index 2f20d53513..47d2a41d21 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java @@ -19,10 +19,7 @@ public class SQLServerWallPermitTableTest extends TestCase { Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases")); } - public void test02() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT system_user;")); - } - + public void test03() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));