From a20d637128f017d98b25a8943669380dca77dab0 Mon Sep 17 00:00:00 2001 From: wenshao Date: Wed, 28 Aug 2013 13:57:40 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=BC=BA=E5=AF=B9hints=E7=9A=84?= =?UTF-8?q?=E9=98=B2=E5=BE=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../druid/wall/spi/MySqlWallVisitor.java | 1019 +++++++++-------- .../bvt/filter/wall/MySqlWallTest134.java | 33 + .../bvt/filter/wall/MySqlWallTest135.java | 33 + .../bvt/filter/wall/MySqlWallTest136.java | 33 + 4 files changed, 617 insertions(+), 501 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest134.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest135.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest136.java diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 54808551aa..92cb6d017e 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -1,501 +1,518 @@ -/* - * Copyright 1999-2011 Alibaba Group Holding Ltd. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package com.alibaba.druid.wall.spi; - -import java.util.ArrayList; -import java.util.List; - -import com.alibaba.druid.sql.SQLUtils; -import com.alibaba.druid.sql.ast.SQLCommentHint; -import com.alibaba.druid.sql.ast.SQLName; -import com.alibaba.druid.sql.ast.SQLObject; -import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; -import com.alibaba.druid.sql.ast.expr.SQLInListExpr; -import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; -import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr; -import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; -import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr; -import com.alibaba.druid.sql.ast.statement.SQLAlterTableStatement; -import com.alibaba.druid.sql.ast.statement.SQLAssignItem; -import com.alibaba.druid.sql.ast.statement.SQLCallStatement; -import com.alibaba.druid.sql.ast.statement.SQLCreateTableStatement; -import com.alibaba.druid.sql.ast.statement.SQLCreateTriggerStatement; -import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; -import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement; -import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; -import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; -import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; -import com.alibaba.druid.sql.ast.statement.SQLSelectItem; -import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; -import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; -import com.alibaba.druid.sql.ast.statement.SQLSetStatement; -import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; -import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlAlterTableStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlCreateTableStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDeleteStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlInsertStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowCreateTableStatement; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnionQuery; -import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement; -import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor; -import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter; -import com.alibaba.druid.util.JdbcConstants; -import com.alibaba.druid.wall.Violation; -import com.alibaba.druid.wall.WallConfig; -import com.alibaba.druid.wall.WallContext; -import com.alibaba.druid.wall.WallProvider; -import com.alibaba.druid.wall.WallSqlTableStat; -import com.alibaba.druid.wall.WallVisitor; -import com.alibaba.druid.wall.violation.ErrorCode; -import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; - -public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor { - - private final WallConfig config; - private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; - - public MySqlWallVisitor(WallProvider provider){ - this.config = provider.getConfig(); - this.provider = provider; - } - - @Override - public String getDbType() { - return JdbcConstants.MYSQL; - } - - @Override - public boolean isSqlModified() { - return sqlModified; - } - - @Override - public void setSqlModified(boolean sqlModified) { - this.sqlModified = sqlModified; - } - - @Override - public WallProvider getProvider() { - return provider; - } - - @Override - public WallConfig getConfig() { - return config; - } - - @Override - public void addViolation(Violation violation) { - this.violations.add(violation); - } - - @Override - public List getViolations() { - return violations; - } - - public boolean visit(SQLInListExpr x) { - WallVisitorUtils.check(this, x); - return true; - } - - public boolean visit(SQLBinaryOpExpr x) { - WallVisitorUtils.check(this, x); - return true; - } - - @Override - public boolean visit(SQLSelectQueryBlock x) { - WallVisitorUtils.checkSelelct(this, x); - - return true; - } - - @Override - public boolean visit(MySqlSelectQueryBlock x) { - WallVisitorUtils.checkSelelct(this, x); - return true; - } - - public boolean visit(SQLSelectGroupByClause x) { - WallVisitorUtils.checkHaving(this, x.getHaving()); - return true; - } - - public boolean visit(MySqlSelectGroupBy x) { - WallVisitorUtils.checkHaving(this, x.getHaving()); - return true; - } - - @Override - public boolean visit(MySqlDeleteStatement x) { - WallVisitorUtils.checkReadOnly(this, x.getFrom()); - - return visit((SQLDeleteStatement) x); - } - - @Override - public boolean visit(SQLDeleteStatement x) { - WallVisitorUtils.checkDelete(this, x); - return true; - } - - @Override - public boolean visit(MySqlUpdateStatement x) { - return visit((SQLUpdateStatement) x); - } - - @Override - public boolean visit(SQLUpdateStatement x) { - WallVisitorUtils.initWallTopStatementContext(); - WallVisitorUtils.checkUpdate(this, x); - return true; - } - - @Override - public void endVisit(SQLUpdateStatement x) { - WallVisitorUtils.clearWallTopStatementContext(); - } - - @Override - public boolean visit(MySqlInsertStatement x) { - return visit((SQLInsertStatement) x); - } - - @Override - public boolean visit(SQLInsertStatement x) { - WallVisitorUtils.initWallTopStatementContext(); - WallVisitorUtils.checkInsert(this, x); - return true; - } - - @Override - public void endVisit(SQLInsertStatement x) { - WallVisitorUtils.clearWallTopStatementContext(); - } - - @Override - public boolean visit(SQLSelectStatement x) { - if (!config.isSelelctAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", - this.toSQL(x))); - return false; - } - - WallVisitorUtils.initWallTopStatementContext(); - return true; - } - - @Override - public void endVisit(SQLSelectStatement x) { - WallVisitorUtils.clearWallTopStatementContext(); - } - - @Override - public boolean visit(Limit x) { - if (x.getRowCount() instanceof SQLNumericLiteralExpr) { - WallContext context = WallContext.current(); - - int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue(); - if (rowCount == 0) { - if (context != null) { - context.incrementWarnnings(); - } - - if (!provider.getConfig().isLimitZeroAllow()) { - this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.LIMIT_ZERO, "limit row 0", - this.toSQL(x))); - } - } - } - return true; - } - - public boolean visit(SQLPropertyExpr x) { - if (x.getOwner() instanceof SQLVariantRefExpr) { - SQLVariantRefExpr varExpr = (SQLVariantRefExpr) x.getOwner(); - SQLObject parent = x.getParent(); - String varName = varExpr.getName(); - if (varName.equalsIgnoreCase("@@session") || varName.equalsIgnoreCase("@@global")) { - if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) { - violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, - "variable in condition not allow", toSQL(x))); - return false; - } - - if (!checkVar(x.getParent(), x.getName())) { - boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x); - if (!isTop) { - boolean allow = true; - if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) { - allow = false; - } - - if (!allow) { - violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, - "variable not allow : " + x.getName(), - toSQL(x))); - } - } - } - return false; - } - } - - WallVisitorUtils.check(this, x); - return true; - } - - public boolean checkVar(SQLObject parent, String varName) { - if (varName == null) { - return false; - } - - if (varName.equals("?")) { - return true; - } - - if (!config.isVariantCheck()) { - return true; - } - - if (varName.startsWith("@@")) { - if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) { - return false; - } - - varName = varName.substring(2); - } - - if (config.getPermitVariants().contains(varName)) { - return true; - } - - return false; - } - - public boolean isDeny(String varName) { - if (varName.startsWith("@@")) { - varName = varName.substring(2); - } - - return config.getDenyVariants().contains(varName); - } - - public boolean visit(SQLVariantRefExpr x) { - String varName = x.getName(); - if (varName == null) { - return false; - } - - if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) { - boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x); - if (!isTop) { - boolean allow = true; - if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) { - allow = false; - } - - if (!allow) { - violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " - + x.getName(), toSQL(x))); - } - } - } - - return false; - } - - @Override - public boolean visit(SQLMethodInvokeExpr x) { - WallVisitorUtils.checkFunction(this, x); - - return true; - } - - public boolean visit(SQLExprTableSource x) { - WallVisitorUtils.check(this, x); - - if (x.getExpr() instanceof SQLName) { - return false; - } - - return true; - } - - @Override - public boolean visit(MySqlOutFileExpr x) { - if (!config.isSelectIntoOutfileAllow()) { - violations.add(new IllegalSQLObjectViolation(ErrorCode.INTO_OUTFILE, "into out file not allow", toSQL(x))); - } - - return true; - } - - @Override - public boolean visit(SQLUnionQuery x) { - WallVisitorUtils.checkUnion(this, x); - - return true; - } - - @Override - public boolean visit(MySqlUnionQuery x) { - WallVisitorUtils.checkUnion(this, x); - - return true; - } - - @Override - public String toSQL(SQLObject obj) { - return SQLUtils.toMySqlString(obj); - } - - @Override - public boolean isDenyTable(String name) { - if (!config.isTableCheck()) { - return false; - } - - return !this.provider.checkDenyTable(name); - } - - public void preVisit(SQLObject x) { - WallVisitorUtils.preVisitCheck(this, x); - } - - @Override - public boolean visit(SQLSelectItem x) { - WallVisitorUtils.check(this, x); - return true; - } - - @Override - public boolean visit(SQLCreateTableStatement x) { - WallVisitorUtils.check(this, x); - return true; - } - - @Override - public boolean visit(MySqlCreateTableStatement x) { - WallVisitorUtils.check(this, x); - return true; - } - - public boolean visit(SQLAlterTableStatement x) { - WallVisitorUtils.check(this, x); - return true; - } - - @Override - public boolean visit(MySqlAlterTableStatement x) { - WallVisitorUtils.check(this, x); - return true; - } - - public boolean visit(SQLDropTableStatement x) { - WallVisitorUtils.check(this, x); - return true; - } - - @Override - public boolean visit(SQLSetStatement x) { - return false; - } - - @Override - public boolean visit(MySqlReplaceStatement x) { - return true; - } - - @Override - public boolean visit(SQLCallStatement x) { - return false; - } - - @Override - public boolean visit(SQLCommentHint x) { - String text = x.getText(); - text = text.trim(); - if (text.startsWith("!")) { - text = text.substring(1); - } - - if (text.length() == 0) { - return true; - } - - if (Character.isDigit(text.charAt(0))) { - addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); - } - - text = text.toLowerCase(); - - if (text.indexOf(';') != -1 // - || text.indexOf("or") != -1 // - || text.indexOf("and") != -1 // - || text.indexOf("union") != -1 // - - || text.indexOf("select") != -1 // - || text.indexOf("delete") != -1 // - || text.indexOf("insert") != -1 // - || text.indexOf("update") != -1 // - - || text.indexOf("create") != -1 // - || text.indexOf("drop") != -1 // - || text.indexOf("alter") != -1 // - || text.indexOf("truncate") != -1 // - - || text.indexOf("information_schema") != -1 // - || text.indexOf("mysql") != -1 // - || text.indexOf("performance_schema") != -1 // - - || text.indexOf("sleep") != -1 // - || text.indexOf("benchmark") != -1 // - || text.indexOf("load_file") != -1 // - ) { - addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); - } - - return true; - } - - @Override - public boolean visit(MySqlShowCreateTableStatement x) { - String tableName = ((SQLName) x.getName()).getSimleName(); - WallContext context = WallContext.current(); - if (context != null) { - WallSqlTableStat tableStat = context.getTableStat(tableName); - if (tableStat != null) { - tableStat.incrementShowCount(); - } - } - return false; - } - - @Override - public boolean visit(SQLCreateTriggerStatement x) { - return false; - } -} +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.wall.spi; + +import java.util.ArrayList; +import java.util.List; + +import com.alibaba.druid.sql.SQLUtils; +import com.alibaba.druid.sql.ast.SQLCommentHint; +import com.alibaba.druid.sql.ast.SQLName; +import com.alibaba.druid.sql.ast.SQLObject; +import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; +import com.alibaba.druid.sql.ast.expr.SQLInListExpr; +import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; +import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr; +import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; +import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr; +import com.alibaba.druid.sql.ast.statement.SQLAlterTableStatement; +import com.alibaba.druid.sql.ast.statement.SQLAssignItem; +import com.alibaba.druid.sql.ast.statement.SQLCallStatement; +import com.alibaba.druid.sql.ast.statement.SQLCreateTableStatement; +import com.alibaba.druid.sql.ast.statement.SQLCreateTriggerStatement; +import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; +import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement; +import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; +import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; +import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; +import com.alibaba.druid.sql.ast.statement.SQLSelectItem; +import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; +import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; +import com.alibaba.druid.sql.ast.statement.SQLSetStatement; +import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; +import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlAlterTableStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlCreateTableStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDeleteStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlInsertStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowCreateTableStatement; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnionQuery; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement; +import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor; +import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter; +import com.alibaba.druid.util.JdbcConstants; +import com.alibaba.druid.wall.Violation; +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallContext; +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.WallSqlTableStat; +import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.violation.ErrorCode; +import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; + +public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisitor, MySqlASTVisitor { + + private final WallConfig config; + private final WallProvider provider; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + + public MySqlWallVisitor(WallProvider provider){ + this.config = provider.getConfig(); + this.provider = provider; + } + + @Override + public String getDbType() { + return JdbcConstants.MYSQL; + } + + @Override + public boolean isSqlModified() { + return sqlModified; + } + + @Override + public void setSqlModified(boolean sqlModified) { + this.sqlModified = sqlModified; + } + + @Override + public WallProvider getProvider() { + return provider; + } + + @Override + public WallConfig getConfig() { + return config; + } + + @Override + public void addViolation(Violation violation) { + this.violations.add(violation); + } + + @Override + public List getViolations() { + return violations; + } + + public boolean visit(SQLInListExpr x) { + WallVisitorUtils.check(this, x); + return true; + } + + public boolean visit(SQLBinaryOpExpr x) { + WallVisitorUtils.check(this, x); + return true; + } + + @Override + public boolean visit(SQLSelectQueryBlock x) { + WallVisitorUtils.checkSelelct(this, x); + + return true; + } + + @Override + public boolean visit(MySqlSelectQueryBlock x) { + WallVisitorUtils.checkSelelct(this, x); + return true; + } + + public boolean visit(SQLSelectGroupByClause x) { + WallVisitorUtils.checkHaving(this, x.getHaving()); + return true; + } + + public boolean visit(MySqlSelectGroupBy x) { + WallVisitorUtils.checkHaving(this, x.getHaving()); + return true; + } + + @Override + public boolean visit(MySqlDeleteStatement x) { + WallVisitorUtils.checkReadOnly(this, x.getFrom()); + + return visit((SQLDeleteStatement) x); + } + + @Override + public boolean visit(SQLDeleteStatement x) { + WallVisitorUtils.checkDelete(this, x); + return true; + } + + @Override + public boolean visit(MySqlUpdateStatement x) { + return visit((SQLUpdateStatement) x); + } + + @Override + public boolean visit(SQLUpdateStatement x) { + WallVisitorUtils.initWallTopStatementContext(); + WallVisitorUtils.checkUpdate(this, x); + return true; + } + + @Override + public void endVisit(SQLUpdateStatement x) { + WallVisitorUtils.clearWallTopStatementContext(); + } + + @Override + public boolean visit(MySqlInsertStatement x) { + return visit((SQLInsertStatement) x); + } + + @Override + public boolean visit(SQLInsertStatement x) { + WallVisitorUtils.initWallTopStatementContext(); + WallVisitorUtils.checkInsert(this, x); + return true; + } + + @Override + public void endVisit(SQLInsertStatement x) { + WallVisitorUtils.clearWallTopStatementContext(); + } + + @Override + public boolean visit(SQLSelectStatement x) { + if (!config.isSelelctAllow()) { + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.SELECT_NOT_ALLOW, "select not allow", + this.toSQL(x))); + return false; + } + + WallVisitorUtils.initWallTopStatementContext(); + return true; + } + + @Override + public void endVisit(SQLSelectStatement x) { + WallVisitorUtils.clearWallTopStatementContext(); + } + + @Override + public boolean visit(Limit x) { + if (x.getRowCount() instanceof SQLNumericLiteralExpr) { + WallContext context = WallContext.current(); + + int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue(); + if (rowCount == 0) { + if (context != null) { + context.incrementWarnnings(); + } + + if (!provider.getConfig().isLimitZeroAllow()) { + this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.LIMIT_ZERO, "limit row 0", + this.toSQL(x))); + } + } + } + return true; + } + + public boolean visit(SQLPropertyExpr x) { + if (x.getOwner() instanceof SQLVariantRefExpr) { + SQLVariantRefExpr varExpr = (SQLVariantRefExpr) x.getOwner(); + SQLObject parent = x.getParent(); + String varName = varExpr.getName(); + if (varName.equalsIgnoreCase("@@session") || varName.equalsIgnoreCase("@@global")) { + if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) { + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, + "variable in condition not allow", toSQL(x))); + return false; + } + + if (!checkVar(x.getParent(), x.getName())) { + boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x); + if (!isTop) { + boolean allow = true; + if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) { + allow = false; + } + + if (!allow) { + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, + "variable not allow : " + x.getName(), + toSQL(x))); + } + } + } + return false; + } + } + + WallVisitorUtils.check(this, x); + return true; + } + + public boolean checkVar(SQLObject parent, String varName) { + if (varName == null) { + return false; + } + + if (varName.equals("?")) { + return true; + } + + if (!config.isVariantCheck()) { + return true; + } + + if (varName.startsWith("@@")) { + if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) { + return false; + } + + varName = varName.substring(2); + } + + if (config.getPermitVariants().contains(varName)) { + return true; + } + + return false; + } + + public boolean isDeny(String varName) { + if (varName.startsWith("@@")) { + varName = varName.substring(2); + } + + return config.getDenyVariants().contains(varName); + } + + public boolean visit(SQLVariantRefExpr x) { + String varName = x.getName(); + if (varName == null) { + return false; + } + + if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) { + boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x); + if (!isTop) { + boolean allow = true; + if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) { + allow = false; + } + + if (!allow) { + violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + + x.getName(), toSQL(x))); + } + } + } + + return false; + } + + @Override + public boolean visit(SQLMethodInvokeExpr x) { + WallVisitorUtils.checkFunction(this, x); + + return true; + } + + public boolean visit(SQLExprTableSource x) { + WallVisitorUtils.check(this, x); + + if (x.getExpr() instanceof SQLName) { + return false; + } + + return true; + } + + @Override + public boolean visit(MySqlOutFileExpr x) { + if (!config.isSelectIntoOutfileAllow()) { + violations.add(new IllegalSQLObjectViolation(ErrorCode.INTO_OUTFILE, "into out file not allow", toSQL(x))); + } + + return true; + } + + @Override + public boolean visit(SQLUnionQuery x) { + WallVisitorUtils.checkUnion(this, x); + + return true; + } + + @Override + public boolean visit(MySqlUnionQuery x) { + WallVisitorUtils.checkUnion(this, x); + + return true; + } + + @Override + public String toSQL(SQLObject obj) { + return SQLUtils.toMySqlString(obj); + } + + @Override + public boolean isDenyTable(String name) { + if (!config.isTableCheck()) { + return false; + } + + return !this.provider.checkDenyTable(name); + } + + public void preVisit(SQLObject x) { + WallVisitorUtils.preVisitCheck(this, x); + } + + @Override + public boolean visit(SQLSelectItem x) { + WallVisitorUtils.check(this, x); + return true; + } + + @Override + public boolean visit(SQLCreateTableStatement x) { + WallVisitorUtils.check(this, x); + return true; + } + + @Override + public boolean visit(MySqlCreateTableStatement x) { + WallVisitorUtils.check(this, x); + return true; + } + + public boolean visit(SQLAlterTableStatement x) { + WallVisitorUtils.check(this, x); + return true; + } + + @Override + public boolean visit(MySqlAlterTableStatement x) { + WallVisitorUtils.check(this, x); + return true; + } + + public boolean visit(SQLDropTableStatement x) { + WallVisitorUtils.check(this, x); + return true; + } + + @Override + public boolean visit(SQLSetStatement x) { + return false; + } + + @Override + public boolean visit(MySqlReplaceStatement x) { + return true; + } + + @Override + public boolean visit(SQLCallStatement x) { + return false; + } + + @Override + public boolean visit(SQLCommentHint x) { + String text = x.getText(); + text = text.trim(); + if (text.startsWith("!")) { + text = text.substring(1); + } + + if (text.length() == 0) { + return true; + } + + if (Character.isDigit(text.charAt(0))) { + addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); + } + + text = text.toLowerCase(); + + for (int i = 0; i < text.length(); ++i) { + char ch = text.charAt(i); + switch (ch) { + case ';': + case '>': + case '=': + case '<': + case '&': + case '|': + case '^': + case '\n': + addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); + default: + break; + } + } + + if (text.indexOf("or") != -1 // + || text.indexOf("and") != -1 // + || text.indexOf("union") != -1 // + + || text.indexOf("select") != -1 // + || text.indexOf("delete") != -1 // + || text.indexOf("insert") != -1 // + || text.indexOf("update") != -1 // + || text.indexOf("into") != -1 // + + || text.indexOf("create") != -1 // + || text.indexOf("drop") != -1 // + || text.indexOf("alter") != -1 // + || text.indexOf("truncate") != -1 // + + || text.indexOf("information_schema") != -1 // + || text.indexOf("mysql") != -1 // + || text.indexOf("performance_schema") != -1 // + + || text.indexOf("sleep") != -1 // + || text.indexOf("benchmark") != -1 // + || text.indexOf("load_file") != -1 // + ) { + addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x))); + } + + return true; + } + + @Override + public boolean visit(MySqlShowCreateTableStatement x) { + String tableName = ((SQLName) x.getName()).getSimleName(); + WallContext context = WallContext.current(); + if (context != null) { + WallSqlTableStat tableStat = context.getTableStat(tableName); + if (tableStat != null) { + tableStat.incrementShowCount(); + } + } + return false; + } + + @Override + public boolean visit(SQLCreateTriggerStatement x) { + return false; + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest134.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest134.java new file mode 100644 index 0000000000..1ee91281f8 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest134.java @@ -0,0 +1,33 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest134 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertFalse(provider.checkValid("SELECT 1 FROM dual WHERE 1 = '1'''''''''''''UNION SELECT '2';")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest135.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest135.java new file mode 100644 index 0000000000..ca6a66a011 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest135.java @@ -0,0 +1,33 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest135 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertFalse(provider.checkValid("SELECT * FROM Users WHERE id = '1' AND MID(VERSION(),1,1) = '5';")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest136.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest136.java new file mode 100644 index 0000000000..7b1eb148ea --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest136.java @@ -0,0 +1,33 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +public class MySqlWallTest136 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertFalse(provider.checkValid("SELECT * FROM Users WHERE id = '1' AND MID(@@VERSION,1,1) = '5';")); + } + +}