diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java index cee93d7a4a..25124711f8 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java @@ -871,15 +871,20 @@ public class SQLExprParser extends SQLParser { public final SQLExpr inRest(SQLExpr expr) { if (lexer.token() == Token.IN) { lexer.nextToken(); - accept(Token.LPAREN); SQLInListExpr inListExpr = new SQLInListExpr(expr); - exprList(inListExpr.getTargetList()); + if (lexer.token() == Token.LPAREN) { + lexer.nextToken(); + exprList(inListExpr.getTargetList()); + accept(Token.RPAREN); + expr = inListExpr; + } else { + SQLExpr itemExpr = primary(); + inListExpr.getTargetList().add(itemExpr); + } + expr = inListExpr; - - accept(Token.RPAREN); - expr = inListExpr; - + if (inListExpr.getTargetList().size() == 1) { SQLExpr targetExpr = inListExpr.getTargetList().get(0); if (targetExpr instanceof SQLQueryExpr) { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java index c9f3ca8428..a5f4ca8f8f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java @@ -24,10 +24,15 @@ import com.alibaba.druid.wall.WallUtils; public class MySqlWallPermitTableTest extends TestCase { - public void test_default() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select * from t union select benchmark( 500000, sha1( 'test' ) ) FROM X")); + public void test_default_true() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql("select * from t union select benchmark( 500000, sha1( 'test' ) ) FROM X")); } + public void test_default_false() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql("select * from t where fid = 1 union select benchmark( 500000, sha1( 'test' ) ) FROM X")); + } + + public void test_allow() throws Exception { WallConfig config = new WallConfig(); config.setTableCheck(false); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java index a653de0a12..b368d1a0b5 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java @@ -31,7 +31,8 @@ public class MySqlWallTest extends TestCase { Assert.assertTrue(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))")); Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'")); - Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X")); + Assert.assertFalse(WallUtils.isValidateMySql("select * from t where fid = 1 union select 15,version() FROM X")); + Assert.assertTrue(WallUtils.isValidateMySql("select 15,version() FROM X")); Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'")); Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest55.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest55.java index 1fd04aec08..459ab285d6 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest55.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest55.java @@ -49,12 +49,20 @@ public class MySqlWallTest55 extends TestCase { Assert.assertEquals(1, provider.getTableStats().size()); } - public void test_false() throws Exception { + public void test_true_2() throws Exception { WallProvider provider = new MySqlWallProvider(); - Assert.assertFalse(provider.checkValid(// + Assert.assertTrue(provider.checkValid(// "SELECT USER() FROM X")); Assert.assertEquals(1, provider.getTableStats().size()); } + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + Assert.assertFalse(provider.checkValid(// + "select * from t where fid = 1 union SELECT USER() FROM X")); + + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java index b4f6fd4a0c..f942a10852 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitFunctionTest.java @@ -30,7 +30,7 @@ import com.alibaba.druid.wall.WallUtils; public class OracleWallPermitFunctionTest extends TestCase { public void test_permitTable() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select * from t union select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X")); + Assert.assertFalse(WallUtils.isValidateOracle("select * from t where fid = 1 union select SYS_CONTEXT ('USERENV', 'CURRENT_USER') from X")); } public void test_permitTable_allow() throws Exception { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java index c4b39f090f..17aa32c6a2 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java @@ -40,9 +40,9 @@ public class OracleWallPermitTableTest extends TestCase { } public void test_permitTable_join() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, tab")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, SYS.TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from t1, SYS.\"TAB\"")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, TAB")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, tab")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, SYS.TAB")); + Assert.assertTrue(WallUtils.isValidateOracle("select * from t1, SYS.\"TAB\"")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/PGDenyFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/PGDenyFunctionTest.java index c533ea5b8d..8e1244ce65 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/PGDenyFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/PGDenyFunctionTest.java @@ -11,7 +11,7 @@ public class PGDenyFunctionTest extends TestCase { public void test_false() throws Exception { Assert.assertFalse(WallUtils.isValidatePostgres(// - "SELECT current_catalog() from t where id = ?")); // + "select * from t where fid = 1 union SELECT current_catalog() from t where id = ?")); // } public void test_true() throws Exception { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 845045b568..0994da2f8c 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -54,7 +54,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { } public void test01() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT user_name() FROM X;")); } public final void test_sp_addsrvrolemenber() throws Exception { @@ -75,12 +75,12 @@ public class SQLServerWallPermitFunctionTest extends TestCase { } public final void test_db_name() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME() FROM X")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT DB_NAME(0) FROM X; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT DB_NAME() FROM X")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT DB_NAME(0) FROM X; ")); } public final void test_host_name() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT HOST_NAME() FROM X")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT HOST_NAME() FROM X")); } /** @@ -89,16 +89,16 @@ public class SQLServerWallPermitFunctionTest extends TestCase { * @throws Exception */ public void test_is_srvrolemember() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘dbcreator’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘bulkadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘diskadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘processadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘serveradmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘setupadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘securityadmin’) FROM X;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’) FROM X; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘dbcreator’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘bulkadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘diskadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘processadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘serveradmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘setupadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘securityadmin’) FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’) FROM X; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("select * from t where fid = 1 UNION SELECT is_srvrolemember(‘sysadmin’, ‘sa’) FROM X; ")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java index 30408dfa45..95cb91d6af 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java @@ -67,7 +67,7 @@ public class SQLServerWallTest_0 extends TestCase { } { String sql = "update dbo.dml_health_check set name='123' where id=OBJECT_ID(N'taobao_order')"; - Assert.assertFalse(provider.checkValid(sql)); + Assert.assertTrue(provider.checkValid(sql)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/sql/oracle/OracleSelectTest46.java b/src/test/java/com/alibaba/druid/bvt/sql/oracle/OracleSelectTest46.java new file mode 100644 index 0000000000..1463ef8cf8 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/sql/oracle/OracleSelectTest46.java @@ -0,0 +1,73 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.sql.oracle; + +import java.util.List; + +import org.junit.Assert; + +import com.alibaba.druid.sql.OracleTest; +import com.alibaba.druid.sql.ast.SQLStatement; +import com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser; +import com.alibaba.druid.sql.dialect.oracle.visitor.OracleSchemaStatVisitor; +import com.alibaba.druid.sql.test.TestUtils; + +public class OracleSelectTest46 extends OracleTest { + + public void test_0() throws Exception { + String sql = // + "select *" // + + " FROM MT_PRODUCT_ORDER T1,MT_ORDER T2 WHERE " // + + " T1.MT_ORDER_ID = T2.MT_ORDER_ID" // + + " and SELLER_SSOID = 1" // + + " AND T1.MT_ORDER_ID = '1'" // + + " AND T1.MT_BATCH_ORDER_ID IN '1'"; // + + OracleStatementParser parser = new OracleStatementParser(sql); + List statementList = parser.parseStatementList(); + SQLStatement stmt = statementList.get(0); + print(statementList); + + Assert.assertEquals(1, statementList.size()); + + OracleSchemaStatVisitor visitor = new OracleSchemaStatVisitor(); + stmt.accept(visitor); + + System.out.println("Tables : " + visitor.getTables()); + System.out.println("fields : " + visitor.getColumns()); + System.out.println("coditions : " + visitor.getConditions()); + System.out.println("relationships : " + visitor.getRelationships()); + System.out.println("orderBy : " + visitor.getOrderByColumns()); + + Assert.assertEquals(2, visitor.getTables().size()); + + Assert.assertEquals(4, visitor.getColumns().size()); + + String text = TestUtils.outputOracle(stmt); + + Assert.assertEquals("SELECT *" // + + "\nFROM MT_PRODUCT_ORDER T1, MT_ORDER T2" // + + "\nWHERE T1.MT_ORDER_ID = T2.MT_ORDER_ID" // + + "\n\tAND SELLER_SSOID = 1" // + + "\n\tAND T1.MT_ORDER_ID = '1'" // + + "\n\tAND T1.MT_BATCH_ORDER_ID IN ('1');"// + + "\n", text); + + // Assert.assertTrue(visitor.getColumns().contains(new TableStat.Column("acduser.vw_acd_info", "xzqh"))); + + // Assert.assertTrue(visitor.getOrderByColumns().contains(new TableStat.Column("employees", "last_name"))); + } +}