Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sqlwall

Browse Source
This commit is contained in:
Yako
2014-08-29 20:30:41 +08:00
parent 0e200b491c
commit 957559082e
2 changed files with 41 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+13 -1
View File
@@ -350,7 +350,19 @@ public class WallVisitorUtils {
for (SQLExpr part : parts) {
if(isFirst(part)) {
Object evalValue = part.getAttribute(EVAL_VALUE);
if(evalValue != null && evalValue instanceof Boolean && (Boolean)evalValue) {
if (evalValue == null) {
if (part instanceof SQLBooleanExpr) {
evalValue = ((SQLBooleanExpr) part).getValue();
} else if (part instanceof SQLNumericLiteralExpr) {
evalValue = ((SQLNumericLiteralExpr) part).getNumber();
} else if (part instanceof SQLCharExpr) {
evalValue = ((SQLCharExpr) part).getText();
} else if (part instanceof SQLNCharExpr) {
evalValue = ((SQLNCharExpr) part).getText();
}
}
Boolean result = SQLEvalVisitorUtils.castToBoolean(evalValue);
if (result != null && result) {
return true;
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+28
View File
@@ -237,4 +237,32 @@ public class MySqlWallTest91 extends TestCase {
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 1 and 1='1'";
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 1 or 1='1'";
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where true or 1='1'";
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 'a' or 1='1'";
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'";
Assert.assertFalse(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true";
Assert.assertFalse(provider.checkValid(sql));
}
}
}