Merge pull request #621 from yakolee/master

improve sqlwall

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -445,6 +445,11 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
 
     @Override
     public boolean visit(SQLCommentHint x) {
+        if(!provider.getConfig().isHintAllow()) {
+            addViolation(new IllegalSQLObjectViolation(ErrorCode.EVIL_HINTS, "hint not allow", SQLUtils.toMySqlString(x)));
+            return true;
+        }
+        
         String text = x.getText();
         text = text.trim();
         if (text.startsWith("!")) {

src/test/java/com/alibaba/druid/bvt/filter/wall/HintTest.java

@@ -0,0 +1,23 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallUtils;
+
+public class HintTest extends TestCase {
+
+    public void test_false() throws Exception {
+        WallConfig config = new WallConfig();
+        config.setHintAllow(false);
+        String sql = "select * from person where id = '3'/**/union select 0,1,v from (select 1,2,user/*!() as v*/) a where '1'<>''";
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); //
+    }
+
+    public void test_true() throws Exception {
+        String sql = "select * from person where id = '3'/**/union select 0,1,v from (select 1,2,user/*!() as v*/) a where '1'<>''";
+        Assert.assertTrue(WallUtils.isValidateMySql(sql)); //
+    }
+}