improve sql-wall

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest119.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest119 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND 5376=3420 AND 'XSDD'='XSDD'";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest120.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest120 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin%' AND SLEEP(5) AND '%'=''";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest121.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest121 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin%' AND (SELECT 6384 FROM(SELECT COUNT(*),CONCAT(0x3a64686c3a,(SELECT (CASE WHEN (3252 = 3252) THEN 1 ELSE 0 END)),0x3a766f723a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'=''";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest122.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest122 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin%' AND 4667=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(115)||CHR(114)||CHR(110)||CHR(58)||(SELECT (CASE WHEN (4667=4667) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(106)||CHR(112)||CHR(122)||CHR(58)||CHR(62))) FROM DUAL) AND '%'=''";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest123.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest123 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin'||(SELECT 'tLrl' FROM DUAL WHERE 3240=3240 AND 5014=3795 )||''";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest124.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest124 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND 5859=5666 AND 'Cuqo' LIKE 'Cuqo'";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest125.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest125 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND 5963=CONVERT(INT,(CHAR(58)+CHAR(108)+CHAR(105)+CHAR(112)+CHAR(58)+(SELECT (CASE WHEN (5963=5963) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(117)+CHAR(107)+CHAR(114)+CHAR(58))) AND 'bSho' LIKE 'bSho'";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest126.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+public class MySqlWallTest126 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setCommentAllow(false);
+
+        String sql = "SELECT name, '******' password, createTime from user where name like 'admin'+(SELECT 'NtTK' WHERE 8000=8000 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL#'";
+
+        Assert.assertFalse(provider.checkValid(sql));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java

@@ -118,7 +118,11 @@ public class SQLServerWallTest_0 extends TestCase {
     public void test_true4() throws Exception {
         WallProvider provider = initWallProvider();
         {
-            String sql = "SELECT tableid, chnname FROM r_temptable INNER JOIN  sys_func_pwr ss ON r_temptable.tableid = ss.mainid INNER JOIN  sys_func_pwr sys ON ss.parentid = sys.funcid  WHERE (ismaintable = 1)  and  1=1  and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 550) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 551) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 391) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 552) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 393) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 396) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4628) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4836) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 394) AND (functype = 8) AND (Closed = 0))) and ss.funcid <> 4298 and ss.funcid <> 7441 AND (ss.funcid IN  (SELECT DISTINCT funcid FROM sys_func_pwr  WHERE (functype = 8) AND (Closed = 0)  ))  ORDER BY sys.sortflag ,ss.sortflag ";
+            String sql = "SELECT tableid, chnname "//
+                    + "FROM r_temptable "//
+                    + "INNER JOIN  sys_func_pwr ss ON r_temptable.tableid = ss.mainid "//
+                    + "INNER JOIN  sys_func_pwr sys ON ss.parentid = sys.funcid  " //
+                    + "WHERE (ismaintable = 1)  and  1=1  and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 550) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 551) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 391) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 552) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 393) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 396) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4628) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 4836) AND (functype = 8) AND (Closed = 0))) and (r_temptable.tableid NOT IN (SELECT DISTINCT mainid FROM sys_func_pwr WHERE (parentid = 394) AND (functype = 8) AND (Closed = 0))) and ss.funcid <> 4298 and ss.funcid <> 7441 AND (ss.funcid IN  (SELECT DISTINCT funcid FROM sys_func_pwr  WHERE (functype = 8) AND (Closed = 0)  ))  ORDER BY sys.sortflag ,ss.sortflag ";
             Assert.assertTrue(provider.checkValid(sql));
         }
     }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java

@@ -27,7 +27,7 @@ import com.alibaba.druid.wall.WallUtils;
  *
  */
 public class WallSelectWhereTest extends TestCase {
-    private String sql = "SELECT F1, F2 WHERE 1 = 1";
+    private String sql = "SELECT F1, F2  from t WHERE 1 = 1";
 
     public void testMySql() throws Exception {
         Assert.assertTrue(WallUtils.isValidateMySql(sql));

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java

@@ -27,7 +27,7 @@ import com.alibaba.druid.wall.WallUtils;
  *
  */
 public class WallSelectWhereTest0 extends TestCase {
-    private String sql = "SELECT F1, F2 WHERE 1 = 1 OR F1 = ?";
+    private String sql = "SELECT F1, F2 from t WHERE 1 = 1 OR F1 = ?";
 
     public void testMySql() throws Exception {
         Assert.assertTrue(WallUtils.isValidateMySql(sql));

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java

@@ -29,18 +29,18 @@ import com.alibaba.druid.wall.WallUtils;
 public class WallSelectWhereTest1 extends TestCase {
 
     public void testMySql_true() throws Exception {
-        Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 WHERE 1 = 1 OR FID = ?"));
+        Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?"));
     }
     
     public void testORACLE_true() throws Exception {
-        Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 WHERE 1 = 1 OR FID = ?"));
+        Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?"));
     }
     
     public void testMySql_false() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 WHERE FID = ? OR 1 = 1"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1"));
     }
     
     public void testORACLE_false() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 WHERE FID = ? OR 1 = 1"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java

@@ -27,7 +27,7 @@ import com.alibaba.druid.wall.WallUtils;
  *
  */
 public class WallSelectWhereTest2 extends TestCase {
-    private String sql = "SELECT F1, F2 WHERE 1 = 1 AND FID = ?";
+    private String sql = "SELECT F1, F2  from t WHERE 1 = 1 AND FID = ?";
 
     public void testMySql() throws Exception {
         Assert.assertTrue(WallUtils.isValidateMySql(sql));