From c1f2e6cc7f56846707d4c181d56e60cc5dd57f65 Mon Sep 17 00:00:00 2001
From: kiki <kiki@Mars.(none)>
Date: Tue, 28 May 2013 19:27:02 +0800
Subject: [PATCH] sql wall visitor

---
 .../druid/wall/spi/SQLServerWallVisitor.java  | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
index e7e91a06ed..c122b229eb 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
@@ -206,12 +206,29 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         }
 
         if (config.isVariantCheck() && varName.startsWith("@@")) {
-            violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "global variable not allow", toSQL(x)));
+
+            boolean allow = true;
+            if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) {
+                allow = false;
+            }
+
+            if (!allow) {
+                violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : "
+                                                                                     + x.getName(), toSQL(x)));
+            }
         }
 
         return false;
     }
 
+    public boolean isDeny(String varName) {
+        if (varName.startsWith("@@")) {
+            varName = varName.substring(2);
+        }
+
+        return config.getDenyVariants().contains(varName);
+    }
+
     @Override
     public boolean visit(SQLServerObjectReferenceExpr x) {
         if (x.getSchema() != null && !provider.checkDenySchema(x.getSchema())) {