Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #444 from cutedemons/master

Browse Source 
improve sql wall
This commit is contained in:
温高铁
2013-09-03 06:10:51 -07:00
parent 653350d221 aad2c221fb
commit a4b266d295
4 changed files with 53 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+4 -3
View File
@@ -452,7 +452,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
}
text = text.toLowerCase();
for (int i = 0; i < text.length(); ++i) {
char ch = text.charAt(i);
switch (ch) {
@@ -464,7 +464,8 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
case '|':
case '^':
case '\n':
addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints", SQLUtils.toMySqlString(x)));
addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "evil hints",
SQLUtils.toMySqlString(x)));
default:
break;
}
@@ -516,4 +517,4 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
}
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+35 -3
View File
@@ -189,7 +189,7 @@ public class WallVisitorUtils {
SQLExpr expr = x.getExpr();
if (expr instanceof SQLVariantRefExpr) {
if ("@".equals(((SQLVariantRefExpr) expr).getName())) {
if (!isTopSelectStatement(expr) && "@".equals(((SQLVariantRefExpr) expr).getName())) {
addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x);
}
}
@@ -1057,7 +1057,7 @@ public class WallVisitorUtils {
leftIsName = true;
}
}
if ((!leftIsName) && caseExpr.getItems().size() > 0) {
SQLCaseExpr.Item item = caseExpr.getItems().get(0);
Object conditionVal = getValue(visitor, item.getConditionExpr());
@@ -1072,7 +1072,7 @@ public class WallVisitorUtils {
return null;
}
public static Object eval(String dbType, SQLObject sqlObject, List<Object> parameters) {
SQLEvalVisitor visitor = SQLEvalVisitorUtils.createEvalVisitor(dbType);
visitor.setParameters(parameters);
@@ -1455,6 +1455,38 @@ public class WallVisitorUtils {
return false;
}
private static boolean isTopSelectStatement(SQLObject x) {
for (;;) {
if ((x.getParent() instanceof SQLExpr) || (x.getParent() instanceof Item)) {
x = x.getParent();
} else {
break;
}
}
if (!(x.getParent() instanceof SQLSelectItem)) {
return false;
}
SQLSelectItem item = (SQLSelectItem) x.getParent();
if (!(item.getParent() instanceof SQLSelectQueryBlock)) {
return false;
}
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) item.getParent();
if (!(queryBlock.getParent() instanceof SQLSelect)) {
return false;
}
SQLSelect select = (SQLSelect) queryBlock.getParent();
if (!(select.getParent() instanceof SQLSelectStatement)) {
return false;
}
SQLSelectStatement stmt = (SQLSelectStatement) select.getParent();
return stmt.getParent() == null;
}
public static boolean check(WallVisitor visitor, SQLExprTableSource x) {
final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get();