Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve sql wall

Browse Source
This commit is contained in:
yakolee
2014-03-26 19:15:17 +08:00
parent c971aec5ba
commit b5eda0cf2e
3 changed files with 57 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+30 -3
View File
@@ -110,7 +110,7 @@ public class MySqlLexer extends Lexer {
return;
}
if (!isAllowComment()) {
if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
throw new NotAllowCommentException();
}
}
@@ -446,7 +446,7 @@ public class MySqlLexer extends Lexer {
return;
}
if (!isAllowComment()) {
if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
throw new NotAllowCommentException();
}
@@ -486,11 +486,38 @@ public class MySqlLexer extends Lexer {
return;
}
if (!isAllowComment()) {
if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
throw new NotAllowCommentException();
}
return;
}
}
private boolean isSafeComment(String comment) {
if (comment == null) {
return true;
}
comment = comment.toLowerCase();
if (comment.indexOf("select") != -1 //
|| comment.indexOf("delete") != -1 //
|| comment.indexOf("insert") != -1 //
|| comment.indexOf("update") != -1 //
|| comment.indexOf("into") != -1 //
|| comment.indexOf("where") != -1 //
|| comment.indexOf("or") != -1 //
|| comment.indexOf("and") != -1 //
|| comment.indexOf("union") != -1 //
|| comment.indexOf('\'') != -1 //
|| comment.indexOf('=') != -1 //
|| comment.indexOf('>') != -1 //
|| comment.indexOf('<') != -1 //
|| comment.indexOf('&') != -1 //
|| comment.indexOf('|') != -1 //
|| comment.indexOf('^') != -1 //
) {
return false;
}
return true;
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_comment.java
+26 -2
View File
@@ -33,13 +33,37 @@ public class MySqlWallTest_comment extends TestCase {
public void test_true() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setCommentAllow(true);
Assert.assertTrue(provider.checkValid(//
"SELECT * FROM T WHERE FID = ? #AND 1"));
Assert.assertEquals(1, provider.getTableStats().size());
}
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setCommentAllow(false);
Assert.assertTrue(provider.checkValid("/* this is comment */ SELECT id FROM t "));
Assert.assertTrue(provider.checkValid("-- this is comment \n SELECT * FROM t"));
Assert.assertTrue(provider.checkValid("#this is comment \n SELECT * FROM t"));
Assert.assertFalse(provider.checkValid("/*!40101fff*/ select * from t"));
Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 #this is comment \n and b=1"));
Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 -- this is comment \n and c=1"));
Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 /* this is comment */ and d=1"));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 \n and e=1"));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- AND c=1 \n and f=1"));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */ and g=1"));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 "));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- and c=1"));
Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */"));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java
+1 -1
View File
@@ -22,7 +22,7 @@ import org.junit.Assert;
import com.alibaba.druid.wall.WallUtils;
public class WallMultiLineCommentTest extends TestCase {
private String sql = "select f1 from t /* xx */ ";
private String sql = "select f1 from t /* xx */";
public void testOracle() throws Exception {
Assert.assertFalse(WallUtils.isValidateOracle(sql));