refactor

src/main/java/com/alibaba/druid/filter/wall/WallConfig.java

@@ -27,14 +27,18 @@ public class WallConfig {
     private boolean             insertAllow                = true;
     private boolean             mergeAllow                 = true;
 
+    private boolean             truncateAllow              = false;
+
     private boolean             shcemaCheck                = true;
     private boolean             tableCheck                 = true;
     private boolean             functionCheck              = true;
+    private boolean             objectCheck                = true;
+    private boolean             variantCheck               = true;
 
     protected final Set<String> permitFunctions            = new HashSet<String>();
     protected final Set<String> permitTables               = new HashSet<String>();
     protected final Set<String> permitSchemas              = new HashSet<String>();
-    protected final Set<String> permitNames                = new HashSet<String>();
+    protected final Set<String> permitVariants             = new HashSet<String>();
     protected final Set<String> permitObjects              = new HashSet<String>();
 
     private String              dir;
@@ -71,7 +75,7 @@ public class WallConfig {
             dir = dir.substring(0, dir.length() - 1);
         }
 
-        loadResource(getPermitNames(), dir + "/permit-name.txt");
+        loadResource(getPermitVariants(), dir + "/permit-var.txt");
         loadResource(getPermitSchemas(), dir + "/permit-schema.txt");
         loadResource(getPermitFunctions(), dir + "/permit-function.txt");
         loadResource(getPermitTables(), dir + "/permit-table.txt");
@@ -86,6 +90,14 @@ public class WallConfig {
         this.noneBaseStatementAllow = noneBaseStatementAllow;
     }
 
+    public boolean isTruncateAllow() {
+        return truncateAllow;
+    }
+
+    public void setTruncateAllow(boolean truncateAllow) {
+        this.truncateAllow = truncateAllow;
+    }
+
     public boolean isSelelctAllow() {
         return selelctAllow;
     }
@@ -206,6 +218,22 @@ public class WallConfig {
         this.functionCheck = functionCheck;
     }
 
+    public boolean isVariantCheck() {
+        return variantCheck;
+    }
+
+    public void setVariantCheck(boolean variantCheck) {
+        this.variantCheck = variantCheck;
+    }
+
+    public boolean isObjectCheck() {
+        return objectCheck;
+    }
+
+    public void setObjectCheck(boolean objectCheck) {
+        this.objectCheck = objectCheck;
+    }
+
     // ///////////////////
 
     public Set<String> getPermitFunctions() {
@@ -220,8 +248,8 @@ public class WallConfig {
         return permitSchemas;
     }
 
-    public Set<String> getPermitNames() {
-        return permitNames;
+    public Set<String> getPermitVariants() {
+        return permitVariants;
     }
 
     public Set<String> getPermitObjects() {

src/main/java/com/alibaba/druid/filter/wall/WallVisitor.java

@@ -11,7 +11,7 @@ public interface WallVisitor extends SQLASTVisitor {
 
     List<Violation> getViolations();
     
-    boolean containsPermitTable(String name);
+    boolean isPermitTable(String name);
 
     String toSQL(SQLObject obj);
 }

src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java

@@ -22,6 +22,7 @@ import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
+import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
 import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
 import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr;
@@ -142,7 +143,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         }
 
         if (varName.startsWith("@@")) {
-            violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
+            violations.add(new IllegalSQLObjectViolation(toSQL(x)));
         }
 
         return false;
@@ -168,7 +169,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
     @Override
     public boolean visit(MySqlOutFileExpr x) {
         if (!config.isSelectIntoOutfileAllow()) {
-            violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
+            violations.add(new IllegalSQLObjectViolation(toSQL(x)));
         }
 
         return true;
@@ -187,7 +188,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
     }
 
     @Override
-    public boolean containsPermitTable(String name) {
+    public boolean isPermitTable(String name) {
         if (!config.isTableCheck()) {
             return false;
         }
@@ -212,9 +213,13 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         } else if (x instanceof SQLDeleteStatement) {
 
         } else if (x instanceof SQLUpdateStatement) {
-
+            
+        } else if (x instanceof SQLTruncateStatement) {
+            if (!config.isTruncateAllow()) {
+                violations.add(new IllegalSQLObjectViolation(toSQL(x)));    
+            }
         } else {
-            violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
+            violations.add(new IllegalSQLObjectViolation(toSQL(x)));
         }
     }
 

src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java

@@ -21,6 +21,7 @@ import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
+import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
 import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement;
@@ -50,7 +51,11 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
     }
 
     public boolean visit(SQLIdentifierExpr x) {
-
+        String name = x.getName();
+        name = WallVisitorUtils.form(name);
+        if (config.getPermitVariants().contains(name)) {
+            getViolations().add(new IllegalSQLObjectViolation(toSQL(x)));
+        }
         return true;
     }
 
@@ -118,7 +123,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
     }
 
     @Override
-    public boolean containsPermitTable(String name) {
+    public boolean isPermitTable(String name) {
         if (!config.isTableCheck()) {
             return false;
         }
@@ -147,8 +152,11 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
 
         } else if (x instanceof SQLUpdateStatement) {
         } else if (x instanceof OracleMultiInsertStatement) {
-
         } else if (x instanceof OracleMergeStatement) {
+        } else if (x instanceof SQLTruncateStatement) {
+            if (!config.isTruncateAllow()) {
+                violations.add(new IllegalSQLObjectViolation(toSQL(x)));    
+            }
         } else {
             violations.add(new IllegalSQLObjectViolation(toSQL(x)));
         }

src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java

@@ -441,7 +441,7 @@ public class WallVisitorUtils {
 
         if (tableName != null) {
             tableName = form(tableName);
-            if (visitor.containsPermitTable(tableName)) {
+            if (visitor.isPermitTable(tableName)) {
                 addViolation(visitor, x);
             }
         }

src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleExceptionStatement.java

@@ -8,7 +8,7 @@ import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.OracleSQLObjectImpl;
 import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVisitor;
 
-public class OracleExceptionStatement extends OracleSQLObjectImpl implements OracleStatement {
+public class OracleExceptionStatement extends OracleStatementImpl implements OracleStatement {
 
     private static final long serialVersionUID = 1L;
     private List<Item>        items            = new ArrayList<Item>();

src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleGrantStatement.java

@@ -4,10 +4,9 @@ import java.util.ArrayList;
 import java.util.List;
 
 import com.alibaba.druid.sql.ast.SQLExpr;
-import com.alibaba.druid.sql.dialect.oracle.ast.OracleSQLObjectImpl;
 import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVisitor;
 
-public class OracleGrantStatement extends OracleSQLObjectImpl implements OracleStatement {
+public class OracleGrantStatement extends OracleStatementImpl implements OracleStatement {
 
     private static final long serialVersionUID = 1L;
 

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest.java

@@ -0,0 +1,26 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallConfig;
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景测试访问Oracle系统对象
+ * 
+ * @author admin
+ */
+public class OracleWallPermitVariantTest extends TestCase {
+
+    public void test_permitTable() throws Exception {
+        WallConfig config = new WallConfig();
+        config.setVariantCheck(false);
+        
+        Assert.assertTrue(WallUtils.isValidateOracle("select UID from dual"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select USER from dual"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select user from dual"));
+    }
+    
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitVariantTest2.java

@@ -0,0 +1,21 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景测试访问Oracle系统对象
+ * 
+ * @author admin
+ */
+public class OracleWallPermitVariantTest2 extends TestCase {
+
+    public void test_permitTable() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle("select UID from dual"));
+        Assert.assertFalse(WallUtils.isValidateOracle("select USER from dual"));
+    }
+    
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest.java

@@ -0,0 +1,32 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallConfig;
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测
+ * @author wenshao
+ *
+ */
+public class WallTruncateTest extends TestCase {
+    private String sql = "TRUNCATE TABLE T1";
+    
+    private WallConfig config = new WallConfig();
+    
+    protected void setUp() throws Exception {
+        //config.setTruncateAllow(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+    
+    public void testORACLE() throws Exception {
+        
+        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest1.java

@@ -0,0 +1,32 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallConfig;
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测
+ * @author wenshao
+ *
+ */
+public class WallTruncateTest1 extends TestCase {
+    private String sql = "TRUNCATE TABLE T1";
+    
+    private WallConfig config = new WallConfig();
+    
+    protected void setUp() throws Exception {
+        config.setTruncateAllow(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
+    }
+    
+    public void testORACLE() throws Exception {
+        
+        Assert.assertTrue(WallUtils.isValidateOracle(sql, config));
+    }
+}

src/test/java/com/alibaba/druid/sql/OnlineOracleTest3.java

@@ -34,7 +34,7 @@ public class OnlineOracleTest3 extends TestCase {
     }
 
     public void test_connect() throws Exception {
-        executeQuery("select * from all_users");
+        executeQuery("select UID, USER FROM DUAL");
     }
 
     public void executeQuery(String sql) throws SQLException {