diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index d667f1b11e..63aadcab69 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -350,7 +350,19 @@ public class WallVisitorUtils { for (SQLExpr part : parts) { if(isFirst(part)) { Object evalValue = part.getAttribute(EVAL_VALUE); - if(evalValue != null && evalValue instanceof Boolean && (Boolean)evalValue) { + if (evalValue == null) { + if (part instanceof SQLBooleanExpr) { + evalValue = ((SQLBooleanExpr) part).getValue(); + } else if (part instanceof SQLNumericLiteralExpr) { + evalValue = ((SQLNumericLiteralExpr) part).getNumber(); + } else if (part instanceof SQLCharExpr) { + evalValue = ((SQLCharExpr) part).getText(); + } else if (part instanceof SQLNCharExpr) { + evalValue = ((SQLNCharExpr) part).getText(); + } + } + Boolean result = SQLEvalVisitorUtils.castToBoolean(evalValue); + if (result != null && result) { return true; } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java index 3b56f8818a..ff00096522 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -237,4 +237,32 @@ public class MySqlWallTest91 extends TestCase { Assert.assertTrue(provider.checkValid(sql)); } } + + public void test() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 1 and 1='1'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 1 or 1='1'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where true or 1='1'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where 'a' or 1='1'"; + Assert.assertTrue(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'"; + Assert.assertFalse(provider.checkValid(sql)); + } + { + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true"; + Assert.assertFalse(provider.checkValid(sql)); + } + } }