Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #447 from cutedemons/master

Browse Source 
improve sql wall
This commit is contained in:
温高铁
2013-09-10 02:37:58 -07:00
parent b8556813f2 65d93d35a7
commit d7b350eeaf
13 changed files with 225 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pom.xml
+1 -1
View File
@@ -11,7 +11,7 @@
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>0.2.26</version>
<version>0.2.27</version>
<packaging>jar</packaging>
<name>druid</name>
src/main/java/com/alibaba/druid/VERSION.java
+2 -2
View File
@@ -19,8 +19,8 @@ public final class VERSION {
public final static int MajorVersion = 0;
public final static int MinorVersion = 2;
public final static int RevisionVersion = 26;
public final static int RevisionVersion = 27;
public static String getVersionNumber() {
return VERSION.MajorVersion + "." + VERSION.MinorVersion + "." + VERSION.RevisionVersion;
}
src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlParameterizedOutputVisitor.java
+6 -2
View File
@@ -15,6 +15,7 @@
*/
package com.alibaba.druid.sql.dialect.mysql.visitor;
import java.security.AccessControlException;
import java.util.List;
import java.util.Properties;
@@ -46,7 +47,10 @@ public class MySqlParameterizedOutputVisitor extends MySqlOutputVisitor implemen
public MySqlParameterizedOutputVisitor(Appendable appender){
super(appender);
configFromPropety(System.getProperties());
try {
configFromPropety(System.getProperties());
} catch (AccessControlException e) {
}
}
public void configFromPropety(Properties properties) {
@@ -87,7 +91,7 @@ public class MySqlParameterizedOutputVisitor extends MySqlOutputVisitor implemen
SQLObject parent = x.getParent();
computeSharding = parent instanceof SQLExprTableSource || parent instanceof SQLPropertyExpr;
}
if (computeSharding) {
int pos = name.lastIndexOf('_');
if (pos != -1 && pos != name.length() - 1) {
src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
+3 -7
View File
@@ -94,7 +94,6 @@ import com.alibaba.druid.util.JdbcUtils;
import com.alibaba.druid.util.Utils;
import com.alibaba.druid.wall.spi.WallVisitorUtils;
import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext;
import com.alibaba.druid.wall.spi.WallVisitorUtils.WallSelectQueryContext;
public class SQLEvalVisitorUtils {
@@ -872,17 +871,14 @@ public class SQLEvalVisitorUtils {
if (x.getOperator() == SQLBinaryOperator.Like) {
if (isAlwayTrueLikePattern(x.getRight())) {
final WallSelectQueryContext wallSelectQueryContext = WallVisitorUtils.getWallSelectQueryContext();
if (wallSelectQueryContext != null) {
wallSelectQueryContext.setTrueLike(Boolean.TRUE);
}
x.putAttribute(WallVisitorUtils.HAS_TRUE_LIKE, Boolean.TRUE);
x.putAttribute(EVAL_VALUE, Boolean.TRUE);
return false;
}
}
if (x.getOperator() == SQLBinaryOperator.NotLike) {
if (isAlwayTrueLikePattern(x)) {
if (isAlwayTrueLikePattern(x.getRight())) {
x.putAttribute(EVAL_VALUE, Boolean.FALSE);
return false;
}
@@ -1063,7 +1059,7 @@ public class SQLEvalVisitorUtils {
if (x instanceof SQLCharExpr) {
String text = ((SQLCharExpr) x).getText();
if (text.length() >= 0) {
if (text.length() > 0) {
for (char ch : text.toCharArray()) {
if (ch != '%') {
return false;
src/main/java/com/alibaba/druid/stat/DruidStatManagerFacade.java
+2 -2
View File
@@ -34,9 +34,9 @@ import com.alibaba.druid.sql.visitor.SQLEvalVisitorUtils;
import com.alibaba.druid.support.http.stat.WebAppStatManager;
import com.alibaba.druid.support.spring.stat.SpringStatManager;
import com.alibaba.druid.util.DruidDataSourceUtils;
import com.alibaba.druid.util.Utils;
import com.alibaba.druid.util.JdbcSqlStatUtils;
import com.alibaba.druid.util.StringUtils;
import com.alibaba.druid.util.Utils;
/**
* 监控相关的对外数据暴露
@@ -245,7 +245,7 @@ public final class DruidStatManagerFacade {
} else if (valueA instanceof List && valueB instanceof List) {
List<Map<String, Object>> mergedList = mergeNamedList((List) valueA, (List) valueB);
newMap.put(key, mergedList);
} else if (valueA instanceof String && valueB instanceof String && valueA.equals(valueB)) {
} else if (valueA instanceof String && valueB instanceof String) {
newMap.put(key, valueA);
} else {
Object sum = SQLEvalVisitorUtils.add(valueA, valueB);
src/main/java/com/alibaba/druid/wall/WallConfig.java
+10 -1
View File
@@ -39,6 +39,7 @@ public class WallConfig implements WallConfigMBean {
private boolean conditionAndAlwayTrueAllow = false;
private boolean conditionDoubleConstAllow = false;
private boolean conditionLikeTrueAllow = false;
private boolean selectAllColumnAllow = true;
@@ -58,7 +59,7 @@ public class WallConfig implements WallConfigMBean {
private boolean setAllow = true;
private boolean commitAllow = true;
private boolean rollbackAllow = true;
private boolean useAllow = false;
private boolean useAllow = true;
private boolean multiStatementAllow = false;
@@ -130,6 +131,14 @@ public class WallConfig implements WallConfigMBean {
this.conditionDoubleConstAllow = conditionDoubleConstAllow;
}
public boolean isConditionLikeTrueAllow() {
return conditionLikeTrueAllow;
}
public void setConditionLikeTrueAllow(boolean conditionLikeTrueAllow) {
this.conditionLikeTrueAllow = conditionLikeTrueAllow;
}
public boolean isLimitZeroAllow() {
return limitZeroAllow;
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+157 -137
View File
@@ -22,6 +22,7 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Enumeration;
import java.util.List;
@@ -117,7 +118,9 @@ import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
public class WallVisitorUtils {
private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class);
private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class);
public final static String HAS_TRUE_LIKE = "hasTrueLike";
public static void check(WallVisitor visitor, SQLInListExpr x) {
@@ -223,98 +226,52 @@ public class WallVisitorUtils {
public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) {
final WallSelectQueryContext old = wallSelectQueryContextLocal.get();
try {
wallSelectQueryContextLocal.set(new WallSelectQueryContext());
for (SQLSelectItem item : x.getSelectList()) {
item.setParent(x);
}
for (SQLSelectItem item : x.getSelectList()) {
item.setParent(x);
}
if (x.getInto() != null) {
checkReadOnly(visitor, x.getInto());
}
if (x.getInto() != null) {
checkReadOnly(visitor, x.getInto());
}
if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) {
addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x);
return;
}
if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) {
addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x);
return;
}
if (x.getFrom() != null) {
x.getFrom().setParent(x);
}
if (x.getFrom() != null) {
x.getFrom().setParent(x);
}
SQLExpr where = x.getWhere();
if (where != null) {
where.setParent(x);
checkCondition(visitor, x.getWhere());
SQLExpr where = x.getWhere();
if (where != null) {
where.setParent(x);
checkCondition(visitor, x.getWhere());
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
if (Boolean.TRUE == whereValue) {
if (queryBlockFromIsNull(visitor, x, false)) {
addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x);
}
if (Boolean.TRUE == whereValue) {
if (queryBlockFromIsNull(visitor, x, false)) {
addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x);
}
boolean isSimpleConstExpr = false;
SQLExpr first = getFirst(where);
if (first == where || first instanceof SQLLiteralExpr) {
isSimpleConstExpr = true;
} else if (first instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first;
if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality
|| binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) {
if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr
&& binaryOpExpr.getRight() instanceof SQLIntegerExpr) {
isSimpleConstExpr = true;
}
}
}
final WallSelectQueryContext current = wallSelectQueryContextLocal.get();
if (!isSimpleConstExpr // 简单表达式
&& !(current != null && current.hasTrueLike()) // eg: like '%%'
) {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x);
}
if (!isSimpleConstExpr(where)) {// 简单表达式
addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x);
}
}
checkConditionForMultiTenant(visitor, x.getWhere(), x);
} finally {
wallSelectQueryContextLocal.set(old);
}
checkConditionForMultiTenant(visitor, x.getWhere(), x);
}
public static void checkHaving(WallVisitor visitor, SQLExpr x) {
if (x == null) {
return;
}
final WallSelectQueryContext old = wallSelectQueryContextLocal.get();
try {
wallSelectQueryContextLocal.set(new WallSelectQueryContext());
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
boolean isSimpleConstExpr = false;
if (x instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) x;
if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality
|| binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) {
if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr
&& binaryOpExpr.getRight() instanceof SQLIntegerExpr) {
isSimpleConstExpr = true;
}
}
}
final WallSelectQueryContext current = wallSelectQueryContextLocal.get();
if (!isSimpleConstExpr && !(current != null && current.hasTrueLike())) {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x);
}
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
if (!isSimpleConstExpr(x)) {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x);
}
} finally {
wallSelectQueryContextLocal.set(old);
}
}
@@ -351,24 +308,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) {
boolean isSimpleConstExpr = false;
SQLExpr first = getFirst(where);
if (first == where) {
isSimpleConstExpr = true;
} else if (first instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first;
if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality
|| binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) {
if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr
&& binaryOpExpr.getRight() instanceof SQLIntegerExpr) {
isSimpleConstExpr = true;
}
}
}
if (!isSimpleConstExpr) {
if (!isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "delete alway true condition not allow", x);
}
}
@@ -377,6 +317,36 @@ public class WallVisitorUtils {
checkConditionForMultiTenant(visitor, x.getWhere(), x);
}
private static boolean isSimpleConstExpr(SQLExpr sqlExpr) {
List<SQLExpr> parts = getParts(sqlExpr);
if (parts.isEmpty()) {
return false;
}
for (SQLExpr part : parts) {
boolean isSimpleConstExpr = false;
if (part == sqlExpr || part instanceof SQLLiteralExpr) {
isSimpleConstExpr = true;
} else if (part instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) part;
if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality
|| binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual
|| binaryOpExpr.getOperator() == SQLBinaryOperator.GreaterThan) {
if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr
&& binaryOpExpr.getRight() instanceof SQLIntegerExpr) {
isSimpleConstExpr = true;
}
}
}
if (!isSimpleConstExpr) {
return false;
}
}
return true;
}
private static void checkCondition(WallVisitor visitor, SQLExpr x) {
if (x == null) {
return;
@@ -584,24 +554,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) {
boolean isSimpleConstExpr = false;
SQLExpr first = getFirst(where);
if (first == where) {
isSimpleConstExpr = true;
} else if (first instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first;
if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality
|| binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) {
if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr
&& binaryOpExpr.getRight() instanceof SQLIntegerExpr) {
isSimpleConstExpr = true;
}
}
}
if (!isSimpleConstExpr) {
if (!isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "update alway true condition not allow", x);
}
}
@@ -741,7 +694,7 @@ public class WallVisitorUtils {
dbType = wallContext.getDbType();
}
return eval(dbType, x, Collections.emptyList());
return eval(visitor, dbType, x, Collections.emptyList());
}
public static SQLExpr getFirst(SQLExpr x) {
@@ -756,6 +709,23 @@ public class WallVisitorUtils {
return x;
}
public static List<SQLExpr> getParts(SQLExpr x) {
List<SQLExpr> exprs = new ArrayList<SQLExpr>();
if (x instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binary = (SQLBinaryOpExpr) x;
if (binary.getOperator() == SQLBinaryOperator.BooleanAnd
|| binary.getOperator() == SQLBinaryOperator.BooleanOr) {
exprs.addAll(getParts(((SQLBinaryOpExpr) x).getLeft()));
exprs.addAll(getParts(((SQLBinaryOpExpr) x).getRight()));
return exprs;
}
}
exprs.add(x);
return exprs;
}
public static boolean isFirst(SQLObject x) {
if (x == null) {
return true;
@@ -844,19 +814,6 @@ public class WallVisitorUtils {
}
}
public static class WallSelectQueryContext {
private boolean trueLike = false;
public boolean hasTrueLike() {
return trueLike;
}
public void setTrueLike(boolean trueLike) {
this.trueLike = trueLike;
}
}
public static class WallTopStatementContext {
private boolean fromSysTable = false;
@@ -931,7 +888,6 @@ public class WallVisitorUtils {
}
private static ThreadLocal<WallConditionContext> wallConditionContextLocal = new ThreadLocal<WallConditionContext>();
private static ThreadLocal<WallSelectQueryContext> wallSelectQueryContextLocal = new ThreadLocal<WallSelectQueryContext>();
private static ThreadLocal<WallTopStatementContext> wallTopStatementContextLocal = new ThreadLocal<WallTopStatementContext>();
public static WallConditionContext getWallConditionContext() {
@@ -950,10 +906,6 @@ public class WallVisitorUtils {
wallTopStatementContextLocal.set(new WallTopStatementContext());
}
public static WallSelectQueryContext getWallSelectQueryContext() {
return wallSelectQueryContextLocal.get();
}
public static Object getConditionValue(WallVisitor visitor, SQLExpr x, boolean alwayTrueCheck) {
final WallConditionContext old = wallConditionContextLocal.get();
try {
@@ -992,13 +944,25 @@ public class WallVisitorUtils {
}
}
public static Object getValueFromAttributes(WallVisitor visitor, SQLObject sqlObject) {
if (sqlObject == null) {
return null;
}
if (visitor != null && visitor.getConfig().isConditionLikeTrueAllow()
&& sqlObject.getAttributes().containsKey(HAS_TRUE_LIKE)) {
return null;
}
return sqlObject.getAttribute(EVAL_VALUE);
}
public static Object getValue(SQLExpr x) {
return getValue(null, x);
}
public static Object getValue(WallVisitor visitor, SQLExpr x) {
if (x != null && x.getAttributes().containsKey(EVAL_VALUE)) {
return x.getAttribute(EVAL_VALUE);
return getValueFromAttributes(visitor, x);
}
if (x instanceof SQLBinaryOpExpr) {
@@ -1044,7 +1008,7 @@ public class WallVisitorUtils {
|| x instanceof SQLInListExpr //
|| x instanceof SQLUnaryExpr //
) {
return eval(dbType, x, Collections.emptyList());
return eval(visitor, dbType, x, Collections.emptyList());
}
if (visitor != null && (!visitor.getConfig().isCaseConditionAllow()) && x instanceof SQLCaseExpr) {
@@ -1067,20 +1031,22 @@ public class WallVisitorUtils {
}
}
return eval(dbType, x, Collections.emptyList());
return eval(visitor, dbType, x, Collections.emptyList());
}
return null;
}
public static Object eval(String dbType, SQLObject sqlObject, List<Object> parameters) {
public static Object eval(WallVisitor wallVisitor, String dbType, SQLObject sqlObject, List<Object> parameters) {
SQLEvalVisitor visitor = SQLEvalVisitorUtils.createEvalVisitor(dbType);
visitor.setParameters(parameters);
visitor.registerFunction("rand", Nil.instance);
sqlObject.accept(visitor);
Object value = SQLEvalVisitorUtils.getValue(sqlObject);
return value;
if (sqlObject instanceof SQLNumericLiteralExpr) {
return ((SQLNumericLiteralExpr) sqlObject).getNumber();
}
return getValueFromAttributes(wallVisitor, sqlObject);
}
public static boolean isSimpleCountTableSource(WallVisitor visitor, SQLTableSource tableSource) {
@@ -1260,7 +1226,7 @@ public class WallVisitorUtils {
owner = WallVisitorUtils.form(owner);
if (isInTableSource(x) && !visitor.getProvider().checkDenySchema(owner)) {
if (!isTopUpdateStatement(x) && !isFirstSelectTableSource(x)) {
if (!isTopUpdateStatement(x) && !isFirstSelectTableSource(x) && !isFirstInSubQuery(x)) {
SQLObject parent = x.getParent();
while (parent != null && !(parent instanceof SQLStatement)) {
parent = parent.getParent();
@@ -1335,6 +1301,60 @@ public class WallVisitorUtils {
return false;
}
private static boolean isFirstInSubQuery(SQLObject x) {
for (;;) {
if (x instanceof SQLExpr) {
x = x.getParent();
} else {
break;
}
}
if (!(x instanceof SQLExprTableSource)) {
return false;
}
SQLSelect sqlSelect = null;
SQLObject parent = x.getParent();
while (parent != null) {
if (parent instanceof SQLSelect) {
sqlSelect = (SQLSelect) parent;
break;
}
x = parent;
parent = x.getParent();
}
if (sqlSelect == null) {
return false;
}
parent = sqlSelect.getParent();
if (!(parent instanceof SQLInSubQueryExpr && isFirst(parent))) {
return false;
}
SQLInSubQueryExpr sqlInSubQueryExpr = (SQLInSubQueryExpr) parent;
if (!(sqlInSubQueryExpr.getParent() instanceof SQLSelectQueryBlock)) {
return false;
}
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) sqlInSubQueryExpr.getParent();
if (!(queryBlock.getParent() instanceof SQLSelect)) {
return false;
}
SQLSelect select = (SQLSelect) queryBlock.getParent();
if (!(select.getParent() instanceof SQLSelectStatement)) {
return false;
}
SQLSelectStatement stmt = (SQLSelectStatement) select.getParent();
return stmt.getParent() == null;
}
private static boolean isFirstSelectTableSource(SQLObject x) {
for (;;) {
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest142.java
+1 -1
View File
@@ -27,7 +27,7 @@ public class MySqlWallTest142 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
String sql = "SELECT * FROM `my_crons` WHERE 1 OR nextrun = '0' ";
String sql = "SELECT * FROM `my_crons` WHERE 1 AND nextrun = '0' ";
Assert.assertTrue(provider.checkValid(sql));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java
+5 -5
View File
@@ -33,20 +33,20 @@ public class MySqlWallTest40 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setUseAllow(false);
Assert.assertFalse(provider.checkValid(//
"use huaianapp")); //
Assert.assertEquals(0, provider.getTableStats().size());
}
public void test_true() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setUseAllow(true);
Assert.assertTrue(provider.checkValid(//
"use huaianapp")); //
"use huaianapp")); //
Assert.assertEquals(0, provider.getTableStats().size());
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+9
View File
@@ -44,6 +44,7 @@ public class MySqlWallTest91 extends TestCase {
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
provider.getConfig().setConditionLikeTrueAllow(true);
return provider;
}
@@ -160,6 +161,14 @@ public class MySqlWallTest91 extends TestCase {
}
}
public void test_true5() {
WallProvider provider = initWallProvider();
{
String sql = "select * from view_featureWarm where 1 = 1 and MaterialID in (select Materialid from material where Code like '%%' and name like '%%' and specs like '%%') and sumbalcqty <> 0";
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test_true() throws Exception {
WallProvider provider = initWallProvider();
{
src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java
+17
View File
@@ -44,6 +44,7 @@ public class SQLServerWallTest_0 extends TestCase {
provider.getConfig().setLimitZeroAllow(true);
provider.getConfig().setCommentAllow(true);
provider.getConfig().setConditionDoubleConstAllow(true);
provider.getConfig().setConditionLikeTrueAllow(true);
return provider;
}
@@ -136,6 +137,22 @@ public class SQLServerWallTest_0 extends TestCase {
}
}
public void test_true6() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select count(1) from [Tiger_Help] where 1 = 1 and id = 1";
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test_true7() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select objjc,objname,pwd,servadd from wfp..wfpsys_user where objname in(select name from master..sysdatabases) ";
Assert.assertTrue(provider.checkValid(sql));
}
}
public void test_true() throws Exception {
WallProvider provider = initWallProvider();
{
src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java
+4 -3
View File
@@ -23,16 +23,17 @@ import com.alibaba.druid.wall.WallUtils;
/**
* 这个场景，检测可疑的Having条件
*
* @author wenshao
*
*/
public class WallSelectWhereTest0 extends TestCase {
private String sql = "SELECT F1, F2 from t WHERE 1 = 1 OR F1 = ?";
private String sql = "SELECT F1, F2 from t WHERE 1 = 1 AND F1 = ?";
public void testMySql() throws Exception {
Assert.assertTrue(WallUtils.isValidateMySql(sql));
}
public void testORACLE() throws Exception {
Assert.assertTrue(WallUtils.isValidateOracle(sql));
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java
+8 -8
View File
@@ -23,24 +23,24 @@ import com.alibaba.druid.wall.WallUtils;
/**
* 这个场景，检测可疑的Having条件
*
* @author wenshao
*
*/
public class WallSelectWhereTest1 extends TestCase {
public void testMySql_true() throws Exception {
Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?"));
Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ?"));
}
public void testORACLE_true() throws Exception {
Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?"));
Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ?"));
}
public void testMySql_false() throws Exception {
Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1"));
Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ? OR 1 = 1"));
}
public void testORACLE_false() throws Exception {
Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1"));
Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ? OR 1 = 1"));
}
}