diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallFilter.java b/src/main/java/com/alibaba/druid/filter/wall/WallFilter.java index 3bcf43c65e..795927b3ec 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallFilter.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallFilter.java @@ -7,11 +7,14 @@ import com.alibaba.druid.filter.FilterAdapter; import com.alibaba.druid.filter.FilterChain; import com.alibaba.druid.filter.wall.spi.MySqlWallProvider; import com.alibaba.druid.filter.wall.spi.MySqlWallVisitor; +import com.alibaba.druid.filter.wall.spi.OracleWallProvider; import com.alibaba.druid.filter.wall.spi.OracleWallVisitor; import com.alibaba.druid.proxy.jdbc.CallableStatementProxy; import com.alibaba.druid.proxy.jdbc.ConnectionProxy; import com.alibaba.druid.proxy.jdbc.DataSourceProxy; import com.alibaba.druid.proxy.jdbc.PreparedStatementProxy; +import com.alibaba.druid.proxy.jdbc.ResultSetProxy; +import com.alibaba.druid.proxy.jdbc.StatementProxy; import com.alibaba.druid.util.JdbcUtils; public class WallFilter extends FilterAdapter { @@ -97,6 +100,69 @@ public class WallFilter extends FilterAdapter { check(connection, sql); return chain.connection_prepareCall(connection, sql, resultSetType, resultSetConcurrency, resultSetHoldability); } + + //////////////// + + @Override + public boolean statement_execute(FilterChain chain, StatementProxy statement, String sql) throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_execute(statement, sql); + } + + @Override + public boolean statement_execute(FilterChain chain, StatementProxy statement, String sql, int autoGeneratedKeys) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_execute(statement, sql, autoGeneratedKeys); + } + + @Override + public boolean statement_execute(FilterChain chain, StatementProxy statement, String sql, int columnIndexes[]) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_execute(statement, sql, columnIndexes); + } + + @Override + public boolean statement_execute(FilterChain chain, StatementProxy statement, String sql, String columnNames[]) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_execute(statement, sql, columnNames); + } + + @Override + public ResultSetProxy statement_executeQuery(FilterChain chain, StatementProxy statement, String sql) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_executeQuery(statement, sql); + } + + @Override + public int statement_executeUpdate(FilterChain chain, StatementProxy statement, String sql) throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_executeUpdate(statement, sql); + } + + @Override + public int statement_executeUpdate(FilterChain chain, StatementProxy statement, String sql, int autoGeneratedKeys) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_executeUpdate(statement, sql, autoGeneratedKeys); + } + + @Override + public int statement_executeUpdate(FilterChain chain, StatementProxy statement, String sql, int columnIndexes[]) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_executeUpdate(statement, sql, columnIndexes); + } + + @Override + public int statement_executeUpdate(FilterChain chain, StatementProxy statement, String sql, String columnNames[]) + throws SQLException { + check(statement.getConnectionProxy(), sql); + return chain.statement_executeUpdate(statement, sql, columnNames); + } public void check(ConnectionProxy connection, String sql) throws SQLException { provider.check(sql, true); @@ -106,6 +172,10 @@ public class WallFilter extends FilterAdapter { if (JdbcUtils.MYSQL.equals(dbType)) { return new MySqlWallProvider(); } + + if (JdbcUtils.ORACLE.equals(dbType)) { + return new OracleWallProvider(); + } throw new IllegalStateException("dbType not support : " + dbType); } diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallProvider.java b/src/main/java/com/alibaba/druid/filter/wall/WallProvider.java index d5863fe2af..0d883b4870 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallProvider.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallProvider.java @@ -85,8 +85,8 @@ public abstract class WallProvider { if (visitor.getViolations().size() > 0) { if (throwException) { - visitor.getViolations().get(0); - throw new WallRuntimeException(); + Violation violation = visitor.getViolations().get(0); + throw new WallRuntimeException(violation.toString()); } else { return false; } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java new file mode 100644 index 0000000000..5dabcf2ef3 --- /dev/null +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java @@ -0,0 +1,6 @@ +package com.alibaba.druid.filter.wall.spi; + + +public class SQLServerWallVisitor { + +} diff --git a/src/main/resources/META-INF/druid-filter-wall-permit-table.txt b/src/main/resources/META-INF/druid-filter-wall-permit-table.txt index 10e6671a7d..42ed3fd339 100644 --- a/src/main/resources/META-INF/druid-filter-wall-permit-table.txt +++ b/src/main/resources/META-INF/druid-filter-wall-permit-table.txt @@ -159,6 +159,165 @@ ALL_OPERATOR_COMMENTS ALL_OPERATORS ALL_OUTLINE_HINTS ALL_OUTLINES +ALL_PART_COL_STATISTICS +ALL_PART_HISTOGRAMS +ALL_PART_INDEXES +ALL_PART_KEY_COLUMNS +ALL_PART_LOBS +ALL_PART_TABLES +ALL_PARTIAL_DROP_TABS +ALL_PENDING_CONV_TABLES +ALL_PLSQL_OBJECT_SETTINGS +ALL_POLICIES +ALL_POLICY_CONTEXTS +ALL_POLICY_GROUPS +ALL_PROCEDURES +ALL_PROPAGATION +ALL_PUBLISHED_COLUMNS +ALL_QUEUE_SCHEDULES +ALL_QUEUE_SUBSCRIBERS +ALL_QUEUE_TABLES +ALL_QUEUES +ALL_REFRESH +ALL_REFRESH_CHILDREN +ALL_REFRESH_DEPENDENCIES +ALL_REFS +ALL_REGISTERED_MVIEWS +ALL_REGISTRY_BANNERS +ALL_REWRITE_EQUIVALENCES +ALL_RULE_SET_RULES +ALL_RULE_SETS +ALL_RULES +ALL_SCHEDULER_CHAIN_RULES +ALL_SCHEDULER_CHAIN_STEPS +ALL_SCHEDULER_CHAINS +ALL_SCHEDULER_CREDENTIALS +ALL_SCHEDULER_DB_DESTS +ALL_SCHEDULER_DESTS +ALL_SCHEDULER_EXTERNAL_DESTS +ALL_SCHEDULER_FILE_WATCHERS +ALL_SCHEDULER_GLOBAL_ATTRIBUTE +ALL_SCHEDULER_GROUP_MEMBERS +ALL_SCHEDULER_GROUPS +ALL_SCHEDULER_JOB_ARGS +ALL_SCHEDULER_JOB_CLASSES +ALL_SCHEDULER_JOB_DESTS +ALL_SCHEDULER_JOB_LOG +ALL_SCHEDULER_JOB_RUN_DETAILS +ALL_SCHEDULER_JOBS +ALL_SCHEDULER_NOTIFICATIONS +ALL_SCHEDULER_PROGRAM_ARGS +ALL_SCHEDULER_PROGRAMS +ALL_SCHEDULER_REMOTE_DATABASES +ALL_SCHEDULER_REMOTE_JOBSTATE +ALL_SCHEDULER_RUNNING_CHAINS +ALL_SCHEDULER_RUNNING_JOBS +ALL_SCHEDULER_SCHEDULES +ALL_SCHEDULER_WINDOW_DETAILS +ALL_SCHEDULER_WINDOW_GROUPS +ALL_SCHEDULER_WINDOW_LOG +ALL_SCHEDULER_WINDOWS +ALL_SCHEDULER_WINGROUP_MEMBERS +ALL_SEC_RELEVANT_COLS +ALL_SECONDARY_OBJECTS +ALL_SEQUENCES +ALL_SERVICES +ALL_SOURCE +ALL_SOURCE_AE +ALL_SOURCE_TABLES +ALL_SQLJ_TYPE_ATTRS +ALL_SQLJ_TYPE_METHODS +ALL_SQLJ_TYPES +ALL_SQLSET +ALL_SQLSET_BINDS +ALL_SQLSET_PLANS +ALL_SQLSET_REFERENCES +ALL_SQLSET_STATEMENTS +ALL_STAT_EXTENSIONS +ALL_STORED_SETTINGS +ALL_STREAMS_COLUMNS +ALL_STREAMS_GLOBAL_RULES +ALL_STREAMS_MESSAGE_CONSUMERS +ALL_STREAMS_MESSAGE_RULES +ALL_STREAMS_NEWLY_SUPPORTED +ALL_STREAMS_RULES +ALL_STREAMS_SCHEMA_RULES +ALL_STREAMS_STMT_HANDLERS +ALL_STREAMS_STMTS +ALL_STREAMS_TABLE_RULES +ALL_STREAMS_TRANSFORM_FUNCTION +ALL_STREAMS_UNSUPPORTED +ALL_SUBPART_COL_STATISTICS +ALL_SUBPART_HISTOGRAMS +ALL_SUBPART_KEY_COLUMNS +ALL_SUBPARTITION_TEMPLATES +ALL_SUBSCRIBED_COLUMNS +ALL_SUBSCRIBED_TABLES +ALL_SUBSCRIPTIONS +ALL_SUMDELTA +ALL_SYNC_CAPTURE +ALL_SYNC_CAPTURE_PREPARED_TABS +ALL_SYNC_CAPTURE_TABLES +ALL_SYNONYMS +ALL_TAB_COL_STATISTICS +ALL_TAB_COLS +ALL_TAB_COLUMNS +ALL_TAB_COMMENTS +ALL_TAB_HISTGRM_PENDING_STATS +ALL_TAB_HISTOGRAMS +ALL_TAB_MODIFICATIONS +ALL_TAB_PARTITIONS +ALL_TAB_PENDING_STATS +ALL_TAB_PRIVS +ALL_TAB_PRIVS_MADE +ALL_TAB_PRIVS_RECD +ALL_TAB_STAT_PREFS +ALL_TAB_STATISTICS +ALL_TAB_STATS_HISTORY +ALL_TAB_SUBPARTITIONS +ALL_TABLES +ALL_TRIGGER_COLS +ALL_TRIGGER_ORDERING +ALL_TRIGGERS +ALL_TSTZ_TAB_COLS +ALL_TSTZ_TABLES +ALL_TYPE_ATTRS +ALL_TYPE_METHODS +ALL_TYPE_VERSIONS +ALL_TYPES +ALL_UNUSED_COL_TABS +ALL_UPDATABLE_COLUMNS +ALL_USERS +ALL_USTATS +ALL_VARRAYS +ALL_VIEWS +ALL_VIEWS_AE +ALL_WARNING_SETTINGS +ALL_XML_INDEXES +ALL_XML_SCHEMAS +ALL_XML_TAB_COLS +ALL_XML_TABLES +ALL_XML_VIEW_COLS +ALL_XML_VIEWS +ALL_XSTREAM_INBOUND +ALL_XSTREAM_INBOUND_PROGRESS +ALL_XSTREAM_OUTBOUND +ALL_XSTREAM_OUTBOUND_PROGRESS +ALL_XSTREAM_RULES +AUDIT_ACTIONS +CAT +CATALOG +CHAINED_ROWS +CHANGE_PROPAGATION_SETS +CHANGE_PROPAGATIONS +CHANGE_SETS +CHANGE_SOURCES +CHANGE_TABLES +CLIENT_RESULT_CACHE_STATS$ +CLU +COL +COLS +DATABASE_PROPERTIES DBA_2PC_NEIGHBORS DBA_2PC_PENDING DBA_ADDM_FDG_BREAKDOWN diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java index b6730edf37..a9412b0d3d 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java @@ -18,6 +18,8 @@ public class OracleWallPermitTableTest extends TestCase { Assert.assertFalse(WallUtils.isValidateOracle("select * from tab")); Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.TAB")); Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.\"TAB\"")); + + Assert.assertFalse(WallUtils.isValidateOracle("select * from all_users")); } public void test_permitTable_subquery() throws Exception { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest.java new file mode 100644 index 0000000000..4bdd3d2512 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest.java @@ -0,0 +1,23 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，被攻击者用于测试当前SQL拥有多少字段 + * @author wenshao + * + */ +public class WallDropTest extends TestCase { + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql("DROP TABLE T1")); + } + + public void testOracle() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle("DROP TABLE T1")); + } +} diff --git a/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java b/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java index 596823059c..cfe738d3c1 100644 --- a/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java +++ b/src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java @@ -30,10 +30,11 @@ public class OnlineOracleTest3 extends TestCase { dataSource.setMaxActive(50); dataSource.setPoolPreparedStatements(true); dataSource.setMaxOpenPreparedStatements(100); +// dataSource.setFilters("wall"); } public void test_connect() throws Exception { - executeQuery("select utl_inaddr.get_host_address from DUAL"); + executeQuery("select * from all_users"); } public void executeQuery(String sql) throws SQLException {