From 9b8d165790ff74ab2c5b5d58996f060ef31736f0 Mon Sep 17 00:00:00 2001 From: wenshao Date: Wed, 28 Aug 2013 10:25:16 +0800 Subject: [PATCH] improve sql wall --- .gitignore | 1 + .../druid/sql/ast/statement/SQLSelect.java | 21 +++++++++ .../druid/sql/parser/SQLSelectParser.java | 4 ++ .../druid/sql/parser/SQLStatementParser.java | 5 --- .../sql/visitor/SQLASTOutputVisitor.java | 4 ++ .../com/alibaba/druid/wall/WallProvider.java | 35 +++++++-------- .../druid/wall/spi/MySqlWallVisitor.java | 40 ++++++++++++++++- .../druid/wall/spi/WallVisitorUtils.java | 15 +++++-- .../druid/wall/violation/ErrorCode.java | 2 + .../violation/IllegalSQLObjectViolation.java | 4 +- .../bvt/filter/wall/MySqlWallTest129.java | 43 +++++++++++++++++++ .../bvt/filter/wall/MySqlWallTest130.java | 43 +++++++++++++++++++ .../bvt/filter/wall/MySqlWallTest131.java | 34 +++++++++++++++ .../bvt/filter/wall/MySqlWallTest132.java | 34 +++++++++++++++ .../bvt/filter/wall/MySqlWallTest133.java | 34 +++++++++++++++ ...MySqlParameterizedOutputVisitorTest_7.java | 34 +++++++++++++++ .../bvt/sql/mysql/MySqlSelectTest_13.java | 2 +- .../bvt/support/json/JSONParserTest4.java | 17 ++++++++ .../bvt/support/json/JSONParserTest5.java | 13 ++++++ src/test/resources/bvt/x.json | 1 + 20 files changed, 357 insertions(+), 29 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest129.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest130.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest131.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest132.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest133.java create mode 100644 src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlParameterizedOutputVisitorTest_7.java create mode 100644 src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest4.java create mode 100644 src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest5.java create mode 100644 src/test/resources/bvt/x.json diff --git a/.gitignore b/.gitignore index ff29a33604..a9cb22fcc2 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ out/ *.iws *.iml /bin +/target diff --git a/src/main/java/com/alibaba/druid/sql/ast/statement/SQLSelect.java b/src/main/java/com/alibaba/druid/sql/ast/statement/SQLSelect.java index 6d221203d5..de08199dcf 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/statement/SQLSelect.java +++ b/src/main/java/com/alibaba/druid/sql/ast/statement/SQLSelect.java @@ -15,6 +15,10 @@ */ package com.alibaba.druid.sql.ast.statement; +import java.util.ArrayList; +import java.util.List; + +import com.alibaba.druid.sql.ast.SQLHint; import com.alibaba.druid.sql.ast.SQLObjectImpl; import com.alibaba.druid.sql.ast.SQLOrderBy; import com.alibaba.druid.sql.visitor.SQLASTVisitor; @@ -25,10 +29,26 @@ public class SQLSelect extends SQLObjectImpl { protected SQLSelectQuery query; protected SQLOrderBy orderBy; + private List hints; + public SQLSelect(){ } + public List getHints() { + if (hints == null) { + hints = new ArrayList(2); + } + return hints; + } + + public int getHintsSize() { + if (hints == null) { + return 0; + } + return hints.size(); + } + public SQLSelect(SQLSelectQuery query){ this.setQuery(query); } @@ -64,6 +84,7 @@ public class SQLSelect extends SQLObjectImpl { if (visitor.visit(this)) { acceptChild(visitor, this.query); acceptChild(visitor, this.orderBy); + acceptChild(visitor, this.hints); } visitor.endVisit(this); diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java index 7487e8b2b7..0997142677 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLSelectParser.java @@ -62,6 +62,10 @@ public class SQLSelectParser extends SQLParser { if (select.getOrderBy() == null) { select.setOrderBy(parseOrderBy()); } + + if (lexer.token() == Token.HINT) { + this.exprParser.parseHints(select.getHints()); + } return select; } diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLStatementParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLStatementParser.java index 474d3c8639..b62ded9360 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLStatementParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLStatementParser.java @@ -290,11 +290,6 @@ public class SQLStatementParser extends SQLParser { continue; } - if (lexer.token() == Token.HINT) { - lexer.nextToken(); - continue; - } - if (lexer.token() == Token.COMMENT) { statementList.add(this.parseComment()); continue; diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLASTOutputVisitor.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLASTOutputVisitor.java index 0c74f07ddc..a621694ac1 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLASTOutputVisitor.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLASTOutputVisitor.java @@ -642,6 +642,10 @@ public class SQLASTOutputVisitor extends SQLASTVisitorAdapter implements Printab println(); x.getOrderBy().accept(this); } + + if (x.getHintsSize() > 0) { + printAndAccept(x.getHints(), ""); + } return false; } diff --git a/src/main/java/com/alibaba/druid/wall/WallProvider.java b/src/main/java/com/alibaba/druid/wall/WallProvider.java index 69aa1eb2bd..8a4dc07900 100644 --- a/src/main/java/com/alibaba/druid/wall/WallProvider.java +++ b/src/main/java/com/alibaba/druid/wall/WallProvider.java @@ -718,6 +718,24 @@ public abstract class WallProvider { } private WallCheckResult checkWhiteAndBlackList(String sql) { + // check black list + if (blackListEnable) { + WallSqlStat sqlStat = getBlackSql(sql); + if (sqlStat != null) { + blackListHitCount.incrementAndGet(); + violationCount.incrementAndGet(); + + if (sqlStat.isSyntaxError()) { + syntaxErrrorCount.incrementAndGet(); + } + + sqlStat.incrementAndGetExecuteCount(); + recordStats(sqlStat.getTableStats(), sqlStat.getFunctionStats()); + + return new WallCheckResult(sqlStat); + } + } + if (whiteListEnable) { WallSqlStat sqlStat = getWhiteSql(sql); if (sqlStat != null) { @@ -736,23 +754,6 @@ public abstract class WallProvider { return new WallCheckResult(sqlStat); } } - // check black list - if (blackListEnable) { - WallSqlStat sqlStat = getBlackSql(sql); - if (sqlStat != null) { - blackListHitCount.incrementAndGet(); - violationCount.incrementAndGet(); - - if (sqlStat.isSyntaxError()) { - syntaxErrrorCount.incrementAndGet(); - } - - sqlStat.incrementAndGetExecuteCount(); - recordStats(sqlStat.getTableStats(), sqlStat.getFunctionStats()); - - return new WallCheckResult(sqlStat); - } - } return null; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index b3b52e26b8..f74e23e3ef 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -19,6 +19,7 @@ import java.util.ArrayList; import java.util.List; import com.alibaba.druid.sql.SQLUtils; +import com.alibaba.druid.sql.ast.SQLCommentHint; import com.alibaba.druid.sql.ast.SQLName; import com.alibaba.druid.sql.ast.SQLObject; import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; @@ -78,7 +79,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi this.config = provider.getConfig(); this.provider = provider; } - + @Override public String getDbType() { return JdbcConstants.MYSQL; @@ -433,6 +434,43 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi return false; } + @Override + public boolean visit(SQLCommentHint x) { + String text = x.getText(); + text = text.trim(); + if (text.startsWith("!")) { + text = text.substring(1); + } + + if (text.length() == 0) { + return true; + } + + if (Character.isDigit(text.charAt(0))) { + addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); + } + + text = text.toLowerCase(); + + if (text.indexOf(';') != -1 // + || text.indexOf("or") != -1 // + || text.indexOf("and") != -1 // + || text.indexOf("union") != -1 // + || text.indexOf("delete") != -1 // + || text.indexOf("update") != -1 // + || text.indexOf("create") != -1 // + || text.indexOf("drop") != -1 // + || text.indexOf("drop") != -1 // + || text.indexOf("information_schema") != -1 // + || text.indexOf("mysql") != -1 // + || text.indexOf("performance_schema") != -1 // + ) { + addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); + } + + return true; + } + @Override public boolean visit(MySqlShowCreateTableStatement x) { String tableName = ((SQLName) x.getName()).getSimleName(); diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 320ff1720f..865dff8342 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -52,6 +52,7 @@ import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr; import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; import com.alibaba.druid.sql.ast.expr.SQLQueryExpr; import com.alibaba.druid.sql.ast.expr.SQLUnaryExpr; +import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr; import com.alibaba.druid.sql.ast.statement.SQLAlterTableStatement; import com.alibaba.druid.sql.ast.statement.SQLCallStatement; import com.alibaba.druid.sql.ast.statement.SQLCreateIndexStatement; @@ -162,11 +163,19 @@ public class WallVisitorUtils { } public static void check(WallVisitor visitor, SQLSelectItem x) { + SQLExpr expr = x.getExpr(); + + if (expr instanceof SQLVariantRefExpr) { + if ("@".equals(((SQLVariantRefExpr) expr).getName())) { + addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x); + } + } + if (visitor.getConfig().isSelectAllColumnAllow()) { return; } - if (x.getExpr() instanceof SQLAllColumnExpr // + if (expr instanceof SQLAllColumnExpr // && x.getParent() instanceof SQLSelectQueryBlock) { SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent(); SQLTableSource from = queryBlock.getFrom(); @@ -1015,7 +1024,7 @@ public class WallVisitorUtils { if (visitor != null) { dbType = visitor.getDbType(); } - + if (x instanceof SQLMethodInvokeExpr // || x instanceof SQLBetweenExpr // || x instanceof SQLInListExpr // @@ -1034,7 +1043,7 @@ public class WallVisitorUtils { addViolation(visitor, ErrorCode.CONST_CASE_CONDITION, "const case condition", caseExpr); } } - + return SQLEvalVisitorUtils.eval(dbType, x, Collections.emptyList(), false); } diff --git a/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java b/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java index 7cb03e9224..644d168fbb 100644 --- a/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java +++ b/src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java @@ -64,6 +64,8 @@ public interface ErrorCode { public final static int DOUBLE_CONST_CONDITION = 2107; public final static int SAME_CONST_LIKE = 2108; public final static int CONST_CASE_CONDITION = 2109; + public final static int EVIL_HINTS = 2110; + public final static int EVIL_NAME = 2111; public final static int NOT_PARAMETERIZED = 2200; public final static int MULTI_TENANT = 2201; diff --git a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java index 1e03a8745e..a5a46f1240 100644 --- a/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java +++ b/src/main/java/com/alibaba/druid/wall/violation/IllegalSQLObjectViolation.java @@ -23,10 +23,10 @@ public class IllegalSQLObjectViolation implements Violation { private final String sqlPart; private final int errorCode; - public IllegalSQLObjectViolation(int errorCode, String message, String condition){ + public IllegalSQLObjectViolation(int errorCode, String message, String sqlPart){ this.errorCode = errorCode; this.message = message; - this.sqlPart = condition; + this.sqlPart = sqlPart; } public String getSqlPart() { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest129.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest129.java new file mode 100644 index 0000000000..2821db32e4 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest129.java @@ -0,0 +1,43 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import java.net.URLDecoder; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest129 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setCommentAllow(false); + + Assert.assertTrue(provider.checkValid("select * from t where id = 1")); + + String sql = "select * from t where id = "; + sql += URLDecoder.decode("999999.9%0A%2F*!30000union%0Aall%0Aselect%0A0x31303235343830303536%2Cconcat%280x7e%2C0x27%2C%28Select%0A%40%40version%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536*%2F--"); + + System.out.println(sql); + Assert.assertFalse(provider.checkValid(sql)); + + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest130.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest130.java new file mode 100644 index 0000000000..20ade2a351 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest130.java @@ -0,0 +1,43 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import java.net.URLDecoder; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest130 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setCommentAllow(false); + + Assert.assertTrue(provider.checkValid("select * from t where id = 1")); + + String sql = "select * from t where id = "; + sql += URLDecoder.decode("999999.9%0A%2F*!30000union%0Aall%0Aselect%0A0x31303235343830303536%2Cconcat%280x7e%2C0x27%2C%28Select%0A%40%40version%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536*%2F"); + + System.out.println(sql); + Assert.assertFalse(provider.checkValid(sql)); + + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest131.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest131.java new file mode 100644 index 0000000000..7b0c88522b --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest131.java @@ -0,0 +1,34 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest131 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setCommentAllow(true); + + Assert.assertFalse(provider.checkValid("select * from t where id = 1 /*!30000union all select 2*/")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest132.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest132.java new file mode 100644 index 0000000000..2b408519cd --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest132.java @@ -0,0 +1,34 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest132 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setCommentAllow(true); + + Assert.assertFalse(provider.checkValid("select * from t where id = 1 UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE version=10;")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest133.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest133.java new file mode 100644 index 0000000000..d64a57a309 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest133.java @@ -0,0 +1,34 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest133 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertFalse(provider.checkValid("select * from t where id = 1 " // + + "UNION SELECT @ from t")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlParameterizedOutputVisitorTest_7.java b/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlParameterizedOutputVisitorTest_7.java new file mode 100644 index 0000000000..1c9fdd8b31 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlParameterizedOutputVisitorTest_7.java @@ -0,0 +1,34 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.sql.mysql; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.sql.visitor.ParameterizedOutputVisitorUtils; +import com.alibaba.druid.util.JdbcConstants; + +public class MySqlParameterizedOutputVisitorTest_7 extends TestCase { + + public void test_hints() throws Exception { + String sql = "select id from t where id = 3 /*!30000union all select 2*/"; + String psql = ParameterizedOutputVisitorUtils.parameterize(sql, JdbcConstants.MYSQL); + Assert.assertEquals("SELECT id" // + + "\nFROM t"// + + "\nWHERE id = ?/*!30000union all select 2*/", psql); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlSelectTest_13.java b/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlSelectTest_13.java index 7342ff3d1f..fc923f6cfb 100644 --- a/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlSelectTest_13.java +++ b/src/test/java/com/alibaba/druid/bvt/sql/mysql/MySqlSelectTest_13.java @@ -61,7 +61,7 @@ public class MySqlSelectTest_13 extends MysqlTest { String output = SQLUtils.toMySqlString(stmt); Assert.assertEquals("SELECT *" // - + "\nFROM test", // + + "\nFROM test/*!40101fff*/", // output); } } diff --git a/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest4.java b/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest4.java new file mode 100644 index 0000000000..6424edf6de --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest4.java @@ -0,0 +1,17 @@ +package com.alibaba.druid.bvt.support.json; + +import java.util.LinkedHashMap; +import java.util.Map; + +import junit.framework.TestCase; + +import com.alibaba.druid.support.json.JSONUtils; +import com.alibaba.druid.util.Utils; + +public class JSONParserTest4 extends TestCase { + public void test_parse() throws Exception { + String text ="{\"\\u0006\":\"123\"}"; + JSONUtils.parse(text); + + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest5.java b/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest5.java new file mode 100644 index 0000000000..35e6d3e34b --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/support/json/JSONParserTest5.java @@ -0,0 +1,13 @@ +package com.alibaba.druid.bvt.support.json; + +import junit.framework.TestCase; + +import com.alibaba.druid.support.json.JSONUtils; +import com.alibaba.druid.util.Utils; + +public class JSONParserTest5 extends TestCase { + public void test_parse() throws Exception { + String text = Utils.readFromResource("bvt/x.json"); + JSONUtils.parse(text); + } +} diff --git a/src/test/resources/bvt/x.json b/src/test/resources/bvt/x.json new file mode 100644 index 0000000000..a74d8c8c0c --- /dev/null +++ b/src/test/resources/bvt/x.json @@ -0,0 +1 @@ +{"checkCount":7254,"hardCheckCount":6489,"violationCount":0,"violationEffectRowCount":0,"blackListHitCount":0,"blackListSize":0,"whiteListHitCount":765,"whiteListSize":29,"syntaxErrrorCount":30,"tables":[{"name":"sc_user_action_histories","selectCount":2,"insertCount":25,"updateCount":16},{"name":"sc_auction_item_watches","selectCount":13},{"name":"sc_products","selectCount":127,"insertCount":1},{"name":"cdb_failedlogins","selectCount":3},{"name":"wiki_synonym","selectCount":5},{"name":"sc_member_bankaccounts","selectCount":3},{"name":"sc_product_categories","selectCount":25},{"name":"sc_member_fav_category","selectCount":1},{"name":"cdb_styles","selectCount":4},{"name":"sc_yz_items","selectCount":128},{"name":"cdb_forums","selectCount":390,"updateCount":12},{"name":"cdb_moderators","selectCount":7},{"name":"sc_blogs","selectCount":8},{"name":"sc_member_account_binding","selectCount":4},{"name":"cdb_usergroups","selectCount":8},{"name":"sc_shop_custom_categories","selectCount":62},{"name":"sc_auction_item_comments","selectCount":26},{"name":"wiki_usergroup","selectCount":20},{"name":"sc_shop_custom_pages","selectCount":62},{"name":"sc_auction_bidwords","selectCount":18},{"name":"sc_stuff_recommended_threads","selectCount":1},{"name":"cdb_sessions","selectCount":313,"deleteCount":91,"insertCount":90,"updateCount":154,"replaceCount":6},{"name":"sc_trades_new","selectCount":47},{"name":"cdb_announcements","selectCount":1},{"name":"sc_auction_item_period","selectCount":1},{"name":"sc_yz_exposubs","selectCount":42},{"name":"cdb_mythreads","selectCount":11,"replaceCount":1},{"name":"sc_auctions","selectCount":59},{"name":"sc_collection_occupation","selectCount":1},{"name":"wiki_edition","selectCount":5},{"name":"sc_register_mobile_code_limit","selectCount":23,"updateCount":23},{"name":"cdb_myposts","selectCount":4,"replaceCount":6},{"name":"sc_events","selectCount":3},{"name":"sc_pincang_camp_2012","selectCount":162},{"name":"sc_messages","selectCount":92,"insertCount":3},{"name":"sc_auction_item_categories","selectCount":79},{"name":"sc_certification_id_cards","selectCount":6},{"name":"sc_bbs_spam_logs","insertCount":1},{"name":"sc_jianding_records","selectCount":95},{"name":"sc_shops","selectCount":22},{"name":"cdb_memberfields","selectCount":591},{"name":"sc_cms_article_comments","selectCount":4},{"name":"cdb_settings","selectCount":1},{"name":"cdb_attachments","selectCount":212,"insertCount":5},{"name":"sc_yz_expos","selectCount":43},{"name":"wiki_category","selectCount":7},{"name":"cdb_forumfields","selectCount":271},{"name":"sc_member_collection_occupation","selectCount":3},{"name":"sc_auction_item_images","selectCount":19},{"name":"cdb_onlinetime","selectCount":5,"updateCount":12},{"name":"wiki_lock","selectCount":2},{"name":"sc_auction_masters","selectCount":6},{"name":"sc_yz_item_comments","selectCount":42},{"name":"cdb_spacecaches","selectCount":6,"replaceCount":15},{"name":"sc_member_addresses","selectCount":3},{"name":"sc_shop_recommend_members","selectCount":20},{"name":"sc_jianding_items","selectCount":111},{"name":"cdb_members","selectCount":965,"updateCount":34},{"name":"wiki_doc","selectCount":17,"updateCount":3},{"name":"cdb_memberspaces","selectCount":9},{"name":"cdb_posts","selectCount":240,"insertCount":7,"updateCount":8},{"name":"sc_auction_item_bids","selectCount":37},{"name":"cdb_favorites","selectCount":4},{"name":"sc_auction_blacklist","selectCount":55},{"name":"sc_item_category_relactions","selectCount":97},{"name":"wiki_session","selectCount":8,"deleteCount":5,"replaceCount":7},{"name":"sc_message_sessions","selectCount":94,"insertCount":6,"updateCount":5},{"name":"cdb_modworks","updateCount":1},{"name":"sc_queues","selectCount":5},{"name":"sc_follows","selectCount":2},{"name":"cdb_ratelog","selectCount":2},{"name":"wiki_attachment","selectCount":2},{"name":"sc_auction_items","selectCount":155,"updateCount":36},{"name":"cdb_threadsmod","selectCount":20},{"name":"cdb_ranks","selectCount":1},{"name":"cdb_threads","selectCount":469,"insertCount":1,"updateCount":8},{"name":"wiki_user","selectCount":5},{"name":"sc_auction_item_autobids","selectCount":14},{"name":"sc_auction_audit_admin","selectCount":20}],"functions":[{"name":"rand","invokeCount":2},{"name":"VALUES","invokeCount":6},{"name":"CONCAT_WS","invokeCount":257}],"blackList":[],"whiteList":[{"sql":"\u0006","executeCount":62},{"sql":"\u0005","executeCount":63},{"sql":"\u0004","executeCount":156},{"sql":"\u000f","executeCount":18},{"sql":"\u000c","executeCount":13},{"sql":"\u000b","executeCount":14},{"sql":"\u0003","executeCount":77},{"sql":"\u0002","executeCount":53},{"sql":" ","executeCount":52},{"sql":"\u0001","executeCount":50},{"sql":"\u0008","executeCount":25},{"sql":"\u0013","executeCount":14},{"sql":"\u0012","executeCount":17},{"sql":"\u0011","executeCount":21},{"sql":"\u0010","executeCount":18},{"sql":"\u000e","executeCount":8},{"sql":"\r","executeCount":9},{"sql":"\u0007","executeCount":18},{"sql":"\u001f","executeCount":9},{"sql":"\u001e","executeCount":9},{"sql":"\u001d","executeCount":9},{"sql":"\u001c","executeCount":9},{"sql":"\u001b","executeCount":12},{"sql":"\u0019","executeCount":8},{"sql":"\u0018","executeCount":12},{"sql":"\u0017","executeCount":11},{"sql":"\u0016","executeCount":12},{"sql":"\u0015","executeCount":14},{"sql":"\u0014","executeCount":1}]} \ No newline at end of file