From b5eda0cf2edb5e70d5ccece9ee89b79d932a9404 Mon Sep 17 00:00:00 2001
From: yakolee <yakolyh@gmail.com>
Date: Wed, 26 Mar 2014 19:15:17 +0800
Subject: [PATCH] improve sql wall

---
 .../sql/dialect/mysql/parser/MySqlLexer.java  | 33 +++++++++++++++++--
 .../filter/wall/MySqlWallTest_comment.java    | 28 ++++++++++++++--
 .../filter/wall/WallMultiLineCommentTest.java |  2 +-
 3 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
index 35316c3e6a..9944ab2acd 100644
--- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
@@ -110,7 +110,7 @@ public class MySqlLexer extends Lexer {
             return;
         }
 
-        if (!isAllowComment()) {
+        if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
             throw new NotAllowCommentException();
         }
     }
@@ -446,7 +446,7 @@ public class MySqlLexer extends Lexer {
                 return;
             }
 
-            if (!isAllowComment()) {
+            if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
                 throw new NotAllowCommentException();
             }
 
@@ -486,11 +486,38 @@ public class MySqlLexer extends Lexer {
                 return;
             }
 
-            if (!isAllowComment()) {
+            if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
                 throw new NotAllowCommentException();
             }
 
             return;
         }
     }
+    
+    private boolean isSafeComment(String comment) {
+        if (comment == null) {
+            return true;
+        }
+        comment = comment.toLowerCase();
+        if (comment.indexOf("select") != -1 //
+            || comment.indexOf("delete") != -1 //
+            || comment.indexOf("insert") != -1 //
+            || comment.indexOf("update") != -1 //
+            || comment.indexOf("into") != -1 //
+            || comment.indexOf("where") != -1 //
+            || comment.indexOf("or") != -1 //
+            || comment.indexOf("and") != -1 //
+            || comment.indexOf("union") != -1 //
+            || comment.indexOf('\'') != -1 //
+            || comment.indexOf('=') != -1 //
+            || comment.indexOf('>') != -1 //
+            || comment.indexOf('<') != -1 //
+            || comment.indexOf('&') != -1 //
+            || comment.indexOf('|') != -1 //
+            || comment.indexOf('^') != -1 //
+        ) {
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_comment.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_comment.java
index be9113f2b4..d5016e6aac 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_comment.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_comment.java
@@ -33,13 +33,37 @@ public class MySqlWallTest_comment extends TestCase {
 
     public void test_true() throws Exception {
         WallProvider provider = new MySqlWallProvider();
-        
+
         provider.getConfig().setCommentAllow(true);
-        
+
         Assert.assertTrue(provider.checkValid(//
         "SELECT * FROM T WHERE FID = ? #AND 1"));
 
         Assert.assertEquals(1, provider.getTableStats().size());
     }
 
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        provider.getConfig().setCommentAllow(false);
+
+        Assert.assertTrue(provider.checkValid("/* this is comment */ SELECT id FROM t "));
+        Assert.assertTrue(provider.checkValid("-- this is comment \n SELECT * FROM t"));
+        Assert.assertTrue(provider.checkValid("#this is comment \n SELECT * FROM t"));
+        
+        Assert.assertFalse(provider.checkValid("/*!40101fff*/ select * from t"));
+
+        Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 #this is comment \n and b=1"));
+        Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 -- this is comment \n and c=1"));
+        Assert.assertTrue(provider.checkValid("SELECT * FROM t where a=1 /* this is comment */ and d=1"));
+
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 \n and e=1"));
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- AND c=1 \n and f=1"));
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */ and g=1"));
+
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 "));
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- and c=1"));
+        Assert.assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */"));
+    }
+
 }
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java
index 39d44cc727..d0d235b252 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java
@@ -22,7 +22,7 @@ import org.junit.Assert;
 import com.alibaba.druid.wall.WallUtils;
 
 public class WallMultiLineCommentTest extends TestCase {
-    private String sql = "select f1 from t /* xx */ ";
+    private String sql = "select f1 from t /* xx */";
     
     public void testOracle() throws Exception {
         Assert.assertFalse(WallUtils.isValidateOracle(sql));