improve sql parser

src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java

@@ -871,15 +871,20 @@ public class SQLExprParser extends SQLParser {
     public final SQLExpr inRest(SQLExpr expr) {
         if (lexer.token() == Token.IN) {
             lexer.nextToken();
-            accept(Token.LPAREN);
 
             SQLInListExpr inListExpr = new SQLInListExpr(expr);
-            exprList(inListExpr.getTargetList());
+            if (lexer.token() == Token.LPAREN) {
+                lexer.nextToken();
+                exprList(inListExpr.getTargetList());
+                accept(Token.RPAREN);
+                expr = inListExpr;
+            } else {
+                SQLExpr itemExpr = primary();
+                inListExpr.getTargetList().add(itemExpr);
+            }
+            
             expr = inListExpr;
-
-            accept(Token.RPAREN);
-            expr = inListExpr;
-
+            
             if (inListExpr.getTargetList().size() == 1) {
                 SQLExpr targetExpr = inListExpr.getTargetList().get(0);
                 if (targetExpr instanceof SQLQueryExpr) {

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java

@@ -24,10 +24,15 @@ import com.alibaba.druid.wall.WallUtils;
 
 public class MySqlWallPermitTableTest extends TestCase {
 
-    public void test_default() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select * from t union select benchmark( 500000, sha1( 'test' ) ) FROM X"));
+    public void test_default_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql("select * from t union select benchmark( 500000, sha1( 'test' ) ) FROM X"));
     }
     
+    public void test_default_false() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from t where fid = 1 union select benchmark( 500000, sha1( 'test' ) ) FROM X"));
+    }
+    
+    
     public void test_allow() throws Exception {
         WallConfig config = new WallConfig();
         config.setTableCheck(false);

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java

@@ -31,7 +31,8 @@ public class MySqlWallTest extends TestCase {
         Assert.assertTrue(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'"));
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select * from t where fid = 1 union select 15,version() FROM X"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select 15,version() FROM X"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'"));
 
         Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns"));

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest55.java

@@ -49,12 +49,20 @@ public class MySqlWallTest55 extends TestCase {
         Assert.assertEquals(1, provider.getTableStats().size());
     }
     
-    public void test_false() throws Exception {
+    public void test_true_2() throws Exception {
         WallProvider provider = new MySqlWallProvider();
         
-        Assert.assertFalse(provider.checkValid(//
+        Assert.assertTrue(provider.checkValid(//
                 "SELECT USER() FROM X"));
         
         Assert.assertEquals(1, provider.getTableStats().size());
     }
+    
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        
+        Assert.assertFalse(provider.checkValid(//
+                "select * from t where fid = 1 union SELECT USER() FROM X"));
+        
+    }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java

@@ -30,7 +30,7 @@ import com.alibaba.druid.wall.WallUtils;
 public class OracleWallPermitFunctionTest extends TestCase {
 
     public void test_permitTable() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from t union select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X"));
+        Assert.assertFalse(WallUtils.isValidateOracle("select * from t where fid = 1 union select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X"));
     }
     
     public void test_permitTable_allow() throws Exception {

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java

@@ -40,9 +40,9 @@ public class OracleWallPermitTableTest extends TestCase {
     }
 
     public void test_permitTable_join() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, TAB"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, tab"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, SYS.TAB"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, SYS.\"TAB\""));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, TAB"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, tab"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, SYS.TAB"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, SYS.\"TAB\""));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/PGDenyFunctionTest.java

@@ -11,7 +11,7 @@ public class PGDenyFunctionTest extends TestCase {
 
     public void test_false() throws Exception {
         Assert.assertFalse(WallUtils.isValidatePostgres(//
-        "SELECT current_catalog() from t where id = ?")); //
+        "select * from t where fid = 1 union SELECT current_catalog() from t where id = ?")); //
     }
 
     public void test_true() throws Exception {

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java

@@ -54,7 +54,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
     }
 
     public void test01() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT user_name() FROM X;"));
     }
 
     public final void test_sp_addsrvrolemenber() throws Exception {
@@ -75,12 +75,12 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
     }
 
     public final void test_db_name() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME() FROM X"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0) FROM X; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT DB_NAME() FROM X"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT DB_NAME(0) FROM X; "));
     }
 
     public final void test_host_name() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME() FROM X"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT HOST_NAME() FROM X"));
     }
 
     /**
@@ -89,16 +89,16 @@ public class SQLServerWallPermitFunctionTest extends TestCase {
      * @throws Exception
      */
     public void test_is_srvrolemember() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin’) FROM X;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X; "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘dbcreator’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘bulkadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘diskadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘processadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘serveradmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘setupadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘securityadmin’) FROM X;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’) FROM X; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; "));
     }
 
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java

@@ -67,7 +67,7 @@ public class SQLServerWallTest_0 extends TestCase {
         }
         {
             String sql = "update dbo.dml_health_check set name='123' where id=OBJECT_ID(N'taobao_order')";
-            Assert.assertFalse(provider.checkValid(sql));
+            Assert.assertTrue(provider.checkValid(sql));
         }
     }
 

src/test/java/com/alibaba/druid/bvt/sql/oracle/OracleSelectTest46.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.oracle;
+
+import java.util.List;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.sql.OracleTest;
+import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser;
+import com.alibaba.druid.sql.dialect.oracle.visitor.OracleSchemaStatVisitor;
+import com.alibaba.druid.sql.test.TestUtils;
+
+public class OracleSelectTest46 extends OracleTest {
+
+    public void test_0() throws Exception {
+        String sql = //
+        "select *" //
+                + " FROM MT_PRODUCT_ORDER T1,MT_ORDER T2 WHERE " //
+                + " T1.MT_ORDER_ID = T2.MT_ORDER_ID" //
+                + " and SELLER_SSOID = 1" //
+                + " AND T1.MT_ORDER_ID = '1'" //
+                + " AND T1.MT_BATCH_ORDER_ID IN '1'"; //
+
+        OracleStatementParser parser = new OracleStatementParser(sql);
+        List<SQLStatement> statementList = parser.parseStatementList();
+        SQLStatement stmt = statementList.get(0);
+        print(statementList);
+
+        Assert.assertEquals(1, statementList.size());
+
+        OracleSchemaStatVisitor visitor = new OracleSchemaStatVisitor();
+        stmt.accept(visitor);
+
+        System.out.println("Tables : " + visitor.getTables());
+        System.out.println("fields : " + visitor.getColumns());
+        System.out.println("coditions : " + visitor.getConditions());
+        System.out.println("relationships : " + visitor.getRelationships());
+        System.out.println("orderBy : " + visitor.getOrderByColumns());
+
+        Assert.assertEquals(2, visitor.getTables().size());
+
+        Assert.assertEquals(4, visitor.getColumns().size());
+
+        String text = TestUtils.outputOracle(stmt);
+
+        Assert.assertEquals("SELECT *" //
+                            + "\nFROM MT_PRODUCT_ORDER T1, MT_ORDER T2" //
+                            + "\nWHERE T1.MT_ORDER_ID = T2.MT_ORDER_ID" //
+                            + "\n\tAND SELLER_SSOID = 1" //
+                            + "\n\tAND T1.MT_ORDER_ID = '1'" //
+                            + "\n\tAND T1.MT_BATCH_ORDER_ID IN ('1');"//
+                            + "\n", text);
+
+        // Assert.assertTrue(visitor.getColumns().contains(new TableStat.Column("acduser.vw_acd_info", "xzqh")));
+
+        // Assert.assertTrue(visitor.getOrderByColumns().contains(new TableStat.Column("employees", "last_name")));
+    }
+}