Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sql wall

Browse Source
This commit is contained in:
kiki
2013-09-03 14:26:45 +08:00
parent dafc78909f
commit aad2c221fb
3 changed files with 49 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+35 -3
View File
@@ -189,7 +189,7 @@ public class WallVisitorUtils {
SQLExpr expr = x.getExpr();
if (expr instanceof SQLVariantRefExpr) {
if ("@".equals(((SQLVariantRefExpr) expr).getName())) {
if (!isTopSelectStatement(expr) && "@".equals(((SQLVariantRefExpr) expr).getName())) {
addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x);
}
}
@@ -1057,7 +1057,7 @@ public class WallVisitorUtils {
leftIsName = true;
}
}
if ((!leftIsName) && caseExpr.getItems().size() > 0) {
SQLCaseExpr.Item item = caseExpr.getItems().get(0);
Object conditionVal = getValue(visitor, item.getConditionExpr());
@@ -1072,7 +1072,7 @@ public class WallVisitorUtils {
return null;
}
public static Object eval(String dbType, SQLObject sqlObject, List<Object> parameters) {
SQLEvalVisitor visitor = SQLEvalVisitorUtils.createEvalVisitor(dbType);
visitor.setParameters(parameters);
@@ -1455,6 +1455,38 @@ public class WallVisitorUtils {
return false;
}
private static boolean isTopSelectStatement(SQLObject x) {
for (;;) {
if ((x.getParent() instanceof SQLExpr) || (x.getParent() instanceof Item)) {
x = x.getParent();
} else {
break;
}
}
if (!(x.getParent() instanceof SQLSelectItem)) {
return false;
}
SQLSelectItem item = (SQLSelectItem) x.getParent();
if (!(item.getParent() instanceof SQLSelectQueryBlock)) {
return false;
}
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) item.getParent();
if (!(queryBlock.getParent() instanceof SQLSelect)) {
return false;
}
SQLSelect select = (SQLSelect) queryBlock.getParent();
if (!(select.getParent() instanceof SQLSelectStatement)) {
return false;
}
SQLSelectStatement stmt = (SQLSelectStatement) select.getParent();
return stmt.getParent() == null;
}
public static boolean check(WallVisitor visitor, SQLExprTableSource x) {
final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get();
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+9
View File
@@ -43,6 +43,7 @@ public class MySqlWallTest91 extends TestCase {
provider.getConfig().setSchemaCheck(true);
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
return provider;
}
@@ -151,6 +152,14 @@ public class MySqlWallTest91 extends TestCase {
}
}
public void test_true4() {
WallProvider provider = initWallProvider();
{
String sql = "SELECT 10006,@";
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test_true() throws Exception {
WallProvider provider = initWallProvider();
{
src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java
+5 -4
View File
@@ -43,6 +43,7 @@ public class SQLServerWallTest_0 extends TestCase {
provider.getConfig().setSchemaCheck(true);
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
return provider;
}
@@ -119,10 +120,10 @@ public class SQLServerWallTest_0 extends TestCase {
WallProvider provider = initWallProvider();
{
String sql = "SELECT tableid, chnname "//
+ "FROM r_temptable "//
+ "INNER JOIN sys_func_pwr ss ON r_temptable.tableid = ss.mainid "//
+ "INNER JOIN sys_func_pwr sys ON ss.parentid = sys.funcid " //
+ "WHERE (ismaintable = 1) and 1=1 and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 550) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 551) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 391) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 552) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 393) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 396) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4628) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4836) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 394) AND (functype = 8) AND (Closed = 0))) and ss.funcid <> 4298 and ss.funcid <> 7441 AND (ss.funcid IN (SELECT DISTINCT funcid FROM sys_func_pwr WHERE (functype = 8) AND (Closed = 0) )) ORDER BY sys.sortflag ,ss.sortflag ";
+ "FROM r_temptable "//
+ "INNER JOIN sys_func_pwr ss ON r_temptable.tableid = ss.mainid "//
+ "INNER JOIN sys_func_pwr sys ON ss.parentid = sys.funcid " //
+ "WHERE (ismaintable = 1) and 1=1 and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 550) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 551) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 391) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 552) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 393) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 396) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4628) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4836) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 394) AND (functype = 8) AND (Closed = 0))) and ss.funcid <> 4298 and ss.funcid <> 7441 AND (ss.funcid IN (SELECT DISTINCT funcid FROM sys_func_pwr WHERE (functype = 8) AND (Closed = 0) )) ORDER BY sys.sortflag ,ss.sortflag ";
Assert.assertTrue(provider.checkValid(sql));
}
}