From 65cf07d29916b0746b94e07efaabaa5cd129007f Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 13:11:02 +0800 Subject: [PATCH 1/8] modify deny variant, function, schema ,table --- .../META-INF/druid/wall/mysql/deny-variant.txt | 2 +- .../druid/wall/sqlserver/deny-function.txt | 15 +++++++++++---- .../META-INF/druid/wall/sqlserver/deny-schema.txt | 5 ++++- .../druid/wall/sqlserver/deny-variant.txt | 2 ++ .../wall/SQLServerWallPermitFunctionTest.java | 2 +- 5 files changed, 19 insertions(+), 7 deletions(-) diff --git a/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt b/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt index 9c0c1da30a..cd5d1b3695 100644 --- a/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt +++ b/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt @@ -1,3 +1,3 @@ basedir version_compile_os -version \ No newline at end of file +datadir \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt index c08c96cec1..8dd4b4ecc1 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt @@ -1,5 +1,12 @@ -sp_executesql -user_name +db_name +col_name +object_id +host_name is_srvrolemember -DB_NAME -HOST_NAME +is_member +opendatasource +openrowset +openquery +has_dbaccess +sp_executesql +user_name \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt index db477f9675..7609c80558 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-schema.txt @@ -1,2 +1,5 @@ master -sys \ No newline at end of file +sys +sysobjects +sysdatabases +information_schema \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt index fda7909c8f..b75d48067d 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-variant.txt @@ -1,2 +1,4 @@ +servername +version user system_user \ No newline at end of file diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java index 39506e3cd8..845045b568 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitFunctionTest.java @@ -54,7 +54,7 @@ public class SQLServerWallPermitFunctionTest extends TestCase { } public void test01() throws Exception { - Assert.assertTrue(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT user_name() FROM X;")); } public final void test_sp_addsrvrolemenber() throws Exception { From ef950ab86370714809b0e4b5c71597ba1efafe4d Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 13:15:52 +0800 Subject: [PATCH 2/8] modify deny variant, function, schema ,table --- .../druid/wall/sqlserver/deny-function.txt | 6 +- .../druid/wall/sqlserver/deny-table.txt | 121 +++--------------- 2 files changed, 24 insertions(+), 103 deletions(-) diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt index 8dd4b4ecc1..9894e9b4bc 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-function.txt @@ -1,12 +1,12 @@ db_name col_name -object_id +user_name host_name +object_id is_srvrolemember is_member opendatasource openrowset openquery has_dbaccess -sp_executesql -user_name \ No newline at end of file +sp_executesql \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt index 9ec6dc3f53..2e5d0e02e1 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt @@ -1,100 +1,21 @@ -sysaltfiles -syslockinfo -syscacheobjects -syslogins -syscharsets -sysmessages -sysconfigures -sysoledbusers -syscurconfigs -sysperfinfo -sysdatabases -sysprocesses -sysdevices -sysremotelogins -syslanguages -sysservers -syscolumns -sysindexkeys -syscomments -sysmembers -sysconstraints -sysobjects -sysdepends -syspermissions -sysfilegroups -sysprotects -sysfiles -sysreferences -sysforeignkeys -systypes -sysfulltextcatalogs -sysusers -sysindexes -sysalerts -sysjobsteps -syscategories -sysnotifications -sysdownloadlist -sysoperators -sysjobhistory -systargetservergroupmembers -sysjobs -systargetservergroups -sysjobschedules -systargetservers -sysjobservers -systaskids -backupfile -restorefile -backupmediafamily -restorefilegroup -backupmediaset -restorehistory -backupset -sysdatabases -sysservers -sysreplicationalerts -msagent_parameters -mspublisher_databases -msagent_profiles -msreplication_objects -msarticles -msreplication_subscriptions -msdistpublishers -msrepl_commands -msdistributiondbs -msrepl_errors -msdistribution_agents -msrepl_originators -msdistribution_history -msrepl_transactions -msdistributor -msrepl_version -mslogreader_agents -mssnapshot_agents -mslogreader_history -mssnapshot_history -msmerge_agents -mssubscriber_info -msmerge_history -mssubscriber_schedule -msmerge_subscriptions -mssubscriptions -mspublication_access -mssubscription_properties -mspublications -msmerge_contents -sysmergearticles -msmerge_delete_conflicts -sysmergepublications -msmerge_genhistory -sysmergeschemachange -msmerge_replinfo -sysmergesubscriptions -msmerge_tombstone -sysmergesubsetfilters -sysarticles -syspublications -sysarticleupdates -syssubscriptions \ No newline at end of file +sysaltfiles +syscharsets +sysconfigures +syscurconfigs +sysdatabases +syslanguages +syslogins +sysoledbusers +sysprocesses +sysremotelogins +syscolumns +sysconstrains +sysfilegroups +sysfiles +sysforeignkeys +sysindexes +sysmenbers +sysobjects +syspermissions +systypes +sysusers \ No newline at end of file From 1c93dd45cd2fd33e640accfb6e5d1d4f4b44177a Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 13:19:00 +0800 Subject: [PATCH 3/8] modify deny variant, function, schema ,table --- .../druid/wall/mysql/deny-variant.txt | 1 + .../druid/wall/sqlserver/deny-table.txt | 103 ++++++++++++++++-- 2 files changed, 92 insertions(+), 12 deletions(-) diff --git a/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt b/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt index cd5d1b3695..ea6d9c3348 100644 --- a/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt +++ b/src/main/resources/META-INF/druid/wall/mysql/deny-variant.txt @@ -1,3 +1,4 @@ basedir version_compile_os +version datadir \ No newline at end of file diff --git a/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt b/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt index 2e5d0e02e1..fa6f6e1e7e 100644 --- a/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt +++ b/src/main/resources/META-INF/druid/wall/sqlserver/deny-table.txt @@ -1,21 +1,100 @@ sysaltfiles -syscharsets -sysconfigures -syscurconfigs -sysdatabases -syslanguages +syslockinfo +syscacheobjects syslogins +syscharsets +sysmessages +sysconfigures sysoledbusers +syscurconfigs +sysperfinfo +sysdatabases sysprocesses +sysdevices sysremotelogins +syslanguages +sysservers syscolumns -sysconstrains -sysfilegroups -sysfiles -sysforeignkeys -sysindexes -sysmenbers +sysindexkeys +syscomments +sysmembers +sysconstraints sysobjects +sysdepends syspermissions +sysfilegroups +sysprotects +sysfiles +sysreferences +sysforeignkeys systypes -sysusers \ No newline at end of file +sysfulltextcatalogs +sysusers +sysindexes +sysalerts +sysjobsteps +syscategories +sysnotifications +sysdownloadlist +sysoperators +sysjobhistory +systargetservergroupmembers +sysjobs +systargetservergroups +sysjobschedules +systargetservers +sysjobservers +systaskids +backupfile +restorefile +backupmediafamily +restorefilegroup +backupmediaset +restorehistory +backupset +sysdatabases +sysservers +sysreplicationalerts +msagent_parameters +mspublisher_databases +msagent_profiles +msreplication_objects +msarticles +msreplication_subscriptions +msdistpublishers +msrepl_commands +msdistributiondbs +msrepl_errors +msdistribution_agents +msrepl_originators +msdistribution_history +msrepl_transactions +msdistributor +msrepl_version +mslogreader_agents +mssnapshot_agents +mslogreader_history +mssnapshot_history +msmerge_agents +mssubscriber_info +msmerge_history +mssubscriber_schedule +msmerge_subscriptions +mssubscriptions +mspublication_access +mssubscription_properties +mspublications +msmerge_contents +sysmergearticles +msmerge_delete_conflicts +sysmergepublications +msmerge_genhistory +sysmergeschemachange +msmerge_replinfo +sysmergesubscriptions +msmerge_tombstone +sysmergesubsetfilters +sysarticles +syspublications +sysarticleupdates +syssubscriptions \ No newline at end of file From 40a3b4364bff0de448eb77c7df8192c0bf15042c Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 13:56:37 +0800 Subject: [PATCH 4/8] fix cannot be cast --- .../java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index e5162fc945..49fe43564d 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -1223,7 +1223,7 @@ public class SQLEvalVisitorUtils { } if (a instanceof String || b instanceof String) { - return ((String) a).compareTo((String) b) > 0; + return castToString(a).compareTo(castToString(b)) > 0; } if (a instanceof BigDecimal || b instanceof BigDecimal) { From d75b1104a54f40fa59c51399b2b5ea7749c91297 Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 14:29:08 +0800 Subject: [PATCH 5/8] fix right() bug --- .../com/alibaba/druid/sql/visitor/functions/Right.java | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/alibaba/druid/sql/visitor/functions/Right.java b/src/main/java/com/alibaba/druid/sql/visitor/functions/Right.java index 718d554d3f..47f210d3e3 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/functions/Right.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/functions/Right.java @@ -22,10 +22,10 @@ import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; import com.alibaba.druid.sql.visitor.SQLEvalVisitor; import com.alibaba.druid.sql.visitor.SQLEvalVisitorUtils; - public class Right implements Function { + public final static Right instance = new Right(); - + public Object eval(SQLEvalVisitor visitor, SQLMethodInvokeExpr x) { if (x.getParameters().size() != 2) { return SQLEvalVisitor.EVAL_ERROR; @@ -45,7 +45,11 @@ public class Right implements Function { String strValue = param0Value.toString(); int intValue = SQLEvalVisitorUtils.castToInteger(param1Value); - String result = strValue.substring(strValue.length() - intValue, strValue.length()); + int start = strValue.length() - intValue; + if (start < 0) { + start = 0; + } + String result = strValue.substring(start, strValue.length()); return result; } } From abd5c4b2ff344f7d2b46efd729e634a6ed6a710b Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 21:31:48 +0800 Subject: [PATCH 6/8] add setParent --- .../druid/sql/ast/expr/SQLBinaryOpExpr.java | 4 ++-- .../druid/sql/ast/expr/SQLCaseExpr.java | 23 +++++++++++++++++-- .../druid/sql/parser/SQLExprParser.java | 2 +- .../druid/sql/visitor/functions/Isnull.java | 2 +- 4 files changed, 25 insertions(+), 6 deletions(-) diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBinaryOpExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBinaryOpExpr.java index c374a2a443..dd87f215e7 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBinaryOpExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLBinaryOpExpr.java @@ -41,8 +41,8 @@ public class SQLBinaryOpExpr extends SQLExprImpl implements Serializable { public SQLBinaryOpExpr(SQLExpr left, SQLExpr right, SQLBinaryOperator operator){ - this.left = left; - this.right = right; + setLeft(left); + setRight(right); this.operator = operator; } diff --git a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLCaseExpr.java b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLCaseExpr.java index 390f9c48cc..826c28424d 100644 --- a/src/main/java/com/alibaba/druid/sql/ast/expr/SQLCaseExpr.java +++ b/src/main/java/com/alibaba/druid/sql/ast/expr/SQLCaseExpr.java @@ -63,6 +63,9 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { } public void setValueExpr(SQLExpr valueExpr) { + if (valueExpr != null) { + valueExpr.setParent(this); + } this.valueExpr = valueExpr; } @@ -71,6 +74,9 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { } public void setElseExpr(SQLExpr elseExpr) { + if (elseExpr != null) { + elseExpr.setParent(this); + } this.elseExpr = elseExpr; } @@ -78,6 +84,13 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { return this.items; } + public void addItem(Item item) { + if (item != null) { + item.setParent(this); + this.items.add(item); + } + } + protected void accept0(SQLASTVisitor visitor) { if (visitor.visit(this)) { acceptChild(visitor, this.valueExpr); @@ -99,8 +112,8 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { public Item(SQLExpr conditionExpr, SQLExpr valueExpr){ - this.conditionExpr = conditionExpr; - this.valueExpr = valueExpr; + setConditionExpr(conditionExpr); + setValueExpr(valueExpr); } public SQLExpr getConditionExpr() { @@ -108,6 +121,9 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { } public void setConditionExpr(SQLExpr conditionExpr) { + if (conditionExpr != null) { + conditionExpr.setParent(this); + } this.conditionExpr = conditionExpr; } @@ -116,6 +132,9 @@ public class SQLCaseExpr extends SQLExprImpl implements Serializable { } public void setValueExpr(SQLExpr valueExpr) { + if (valueExpr != null) { + valueExpr.setParent(this); + } this.valueExpr = valueExpr; } diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java index d78e405e37..9daf0f2e29 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLExprParser.java @@ -241,7 +241,7 @@ public class SQLExprParser extends SQLParser { accept(Token.THEN); SQLExpr valueExpr = expr(); SQLCaseExpr.Item caseItem = new SQLCaseExpr.Item(testExpr, valueExpr); - caseExpr.getItems().add(caseItem); + caseExpr.addItem(caseItem); while (lexer.token() == Token.WHEN) { lexer.nextToken(); diff --git a/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java b/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java index f0cd82fbb2..43e6056426 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java @@ -38,7 +38,7 @@ public class Isnull implements Function { SQLExpr condition = parameters.get(0); condition.accept(visitor); Object itemValue = condition.getAttributes().get(EVAL_VALUE); - if (itemValue == null || itemValue == EVAL_VALUE_NULL) { + if (itemValue == EVAL_VALUE_NULL) { return Boolean.TRUE; } else { return Boolean.FALSE; From f7ca97224a7182a01ebb19325aef1ce512f9b855 Mon Sep 17 00:00:00 2001 From: kiki Date: Thu, 6 Jun 2013 22:27:01 +0800 Subject: [PATCH 7/8] fix Isnull --- .../java/com/alibaba/druid/sql/visitor/functions/Isnull.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java b/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java index 43e6056426..dc2f388f30 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/functions/Isnull.java @@ -40,6 +40,8 @@ public class Isnull implements Function { Object itemValue = condition.getAttributes().get(EVAL_VALUE); if (itemValue == EVAL_VALUE_NULL) { return Boolean.TRUE; + } else if (itemValue == null) { + return null; } else { return Boolean.FALSE; } From 4b2724d11826b2e8878b5472dc712b252fa3a7df Mon Sep 17 00:00:00 2001 From: kiki Date: Fri, 7 Jun 2013 18:46:17 +0800 Subject: [PATCH 8/8] add list judge --- .../druid/sql/visitor/SQLEvalVisitorUtils.java | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index 49fe43564d..9d2ac6a147 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -797,6 +797,9 @@ public class SQLEvalVisitorUtils { wallConditionContext.setConstArithmetic(true); } + leftValue = processValue(leftValue); + rightValue = processValue(rightValue); + if (leftValue == null || rightValue == null) { return false; } @@ -890,6 +893,17 @@ public class SQLEvalVisitorUtils { return false; } + @SuppressWarnings("rawtypes") + private static Object processValue(Object value) { + if (value instanceof List) { + List list = (List) value; + if (list.size() == 1) { + return processValue(list.get(0)); + } + } + return value; + } + private static boolean isAlwayTrueLikePattern(SQLExpr x) { if (x instanceof SQLCharExpr) { String text = ((SQLCharExpr) x).getText();