diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java index 425ba50e1a..051a9bd3e7 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java @@ -452,8 +452,8 @@ public class MySqlLexer extends Lexer { } endOfComment = isEOF(); - - if (!isHint && !isAllowComment() && (isEOF() || !isSafeComment(stringVal))) { + + if (!isHint && !isAllowComment() && !isSafeComment(stringVal)) { throw new NotAllowCommentException(); } @@ -503,38 +503,11 @@ public class MySqlLexer extends Lexer { return; } } - - private boolean isSafeComment(String comment) { - if (comment == null) { - return true; - } - comment = comment.toLowerCase(); - if (comment.indexOf("select") != -1 // - || comment.indexOf("delete") != -1 // - || comment.indexOf("insert") != -1 // - || comment.indexOf("update") != -1 // - || comment.indexOf("into") != -1 // - || comment.indexOf("where") != -1 // - || comment.indexOf("or") != -1 // - || comment.indexOf("and") != -1 // - || comment.indexOf("union") != -1 // - || comment.indexOf('\'') != -1 // - || comment.indexOf('=') != -1 // - || comment.indexOf('>') != -1 // - || comment.indexOf('<') != -1 // - || comment.indexOf('&') != -1 // - || comment.indexOf('|') != -1 // - || comment.indexOf('^') != -1 // - ) { - return false; - } - return true; - } - + private boolean isIdentifierChar(char c) { return c != '#' && CharTypes.isIdentifierChar(c); } - + public void scanNumber() { mark = pos; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java index d3fe54c31c..0f50a6fc91 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java @@ -108,17 +108,13 @@ public class SQLServerLexer extends Lexer { hasComment = true; } - if (token != Token.HINT && !isAllowComment()) { + if (token != Token.HINT && !isAllowComment() && !isSafeComment(stringVal)) { throw new NotAllowCommentException(); } return; } - if (!isAllowComment()) { - throw new NotAllowCommentException(); - } - if (ch == '/' || ch == '-') { scanChar(); bufPos++; @@ -150,6 +146,10 @@ public class SQLServerLexer extends Lexer { token = Token.LINE_COMMENT; hasComment = true; endOfComment = isEOF(); + + if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) { + throw new NotAllowCommentException(); + } return; } } diff --git a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java index 7b6e57a0f1..503b1e85f3 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java +++ b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java @@ -1064,5 +1064,32 @@ public class Lexer { public boolean isEndOfComment() { return endOfComment; } + + protected boolean isSafeComment(String comment) { + if (comment == null) { + return true; + } + comment = comment.toLowerCase(); + if (comment.indexOf("select") != -1 // + || comment.indexOf("delete") != -1 // + || comment.indexOf("insert") != -1 // + || comment.indexOf("update") != -1 // + || comment.indexOf("into") != -1 // + || comment.indexOf("where") != -1 // + || comment.indexOf("or") != -1 // + || comment.indexOf("and") != -1 // + || comment.indexOf("union") != -1 // + || comment.indexOf('\'') != -1 // + || comment.indexOf('=') != -1 // + || comment.indexOf('>') != -1 // + || comment.indexOf('<') != -1 // + || comment.indexOf('&') != -1 // + || comment.indexOf('|') != -1 // + || comment.indexOf('^') != -1 // + ) { + return false; + } + return true; + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java index 3817916c03..72e9f34d7f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java @@ -56,7 +56,7 @@ public class SQLServerWallTest extends TestCase { public void test_stuff() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from table where version = @@version")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT 1 — comment")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT /*comment*/1")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from t where a=1 /* and b=1*/")); Assert.assertFalse(WallUtils.isValidateSqlServer("WAITFOR DELAY ’0:0:5′ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;")); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java index d0d235b252..4434e43293 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java @@ -22,7 +22,7 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; public class WallMultiLineCommentTest extends TestCase { - private String sql = "select f1 from t /* xx */"; + private String sql = "select f1 from t where a=1 /* and b=1 */"; public void testOracle() throws Exception { Assert.assertFalse(WallUtils.isValidateOracle(sql));