Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

sql wall visitor

Browse Source
This commit is contained in:
kiki
2013-05-28 19:27:02 +08:00
parent 1b26e3dc0c
commit c1f2e6cc7f
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+18 -1
View File
@@ -206,12 +206,29 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
}
if (config.isVariantCheck() && varName.startsWith("@@")) {
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "global variable not allow", toSQL(x)));
boolean allow = true;
if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) {
allow = false;
}
if (!allow) {
violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : "
+ x.getName(), toSQL(x)));
}
}
return false;
}
public boolean isDeny(String varName) {
if (varName.startsWith("@@")) {
varName = varName.substring(2);
}
return config.getDenyVariants().contains(varName);
}
@Override
public boolean visit(SQLServerObjectReferenceExpr x) {
if (x.getSchema() != null && !provider.checkDenySchema(x.getSchema())) {