From afca1fe18fb753b9df52b0dac1a70ad2165470f7 Mon Sep 17 00:00:00 2001 From: kiki Date: Tue, 10 Sep 2013 14:19:56 +0800 Subject: [PATCH 1/2] improve sql wall --- .../MySqlParameterizedOutputVisitor.java | 8 +- .../sql/visitor/SQLEvalVisitorUtils.java | 10 +- .../druid/stat/DruidStatManagerFacade.java | 4 +- .../com/alibaba/druid/wall/WallConfig.java | 11 +- .../druid/wall/spi/WallVisitorUtils.java | 294 ++++++++++-------- .../bvt/filter/wall/MySqlWallTest142.java | 2 +- .../bvt/filter/wall/MySqlWallTest91.java | 9 + .../bvt/filter/wall/SQLServerWallTest_0.java | 17 + .../bvt/filter/wall/WallSelectWhereTest0.java | 7 +- .../bvt/filter/wall/WallSelectWhereTest1.java | 16 +- 10 files changed, 217 insertions(+), 161 deletions(-) diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlParameterizedOutputVisitor.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlParameterizedOutputVisitor.java index 2ffe1f754c..e3a06c4e8c 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlParameterizedOutputVisitor.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlParameterizedOutputVisitor.java @@ -15,6 +15,7 @@ */ package com.alibaba.druid.sql.dialect.mysql.visitor; +import java.security.AccessControlException; import java.util.List; import java.util.Properties; @@ -46,7 +47,10 @@ public class MySqlParameterizedOutputVisitor extends MySqlOutputVisitor implemen public MySqlParameterizedOutputVisitor(Appendable appender){ super(appender); - configFromPropety(System.getProperties()); + try { + configFromPropety(System.getProperties()); + } catch (AccessControlException e) { + } } public void configFromPropety(Properties properties) { @@ -87,7 +91,7 @@ public class MySqlParameterizedOutputVisitor extends MySqlOutputVisitor implemen SQLObject parent = x.getParent(); computeSharding = parent instanceof SQLExprTableSource || parent instanceof SQLPropertyExpr; } - + if (computeSharding) { int pos = name.lastIndexOf('_'); if (pos != -1 && pos != name.length() - 1) { diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index ee15695723..c2634ce5e4 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -94,7 +94,6 @@ import com.alibaba.druid.util.JdbcUtils; import com.alibaba.druid.util.Utils; import com.alibaba.druid.wall.spi.WallVisitorUtils; import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext; -import com.alibaba.druid.wall.spi.WallVisitorUtils.WallSelectQueryContext; public class SQLEvalVisitorUtils { @@ -872,17 +871,14 @@ public class SQLEvalVisitorUtils { if (x.getOperator() == SQLBinaryOperator.Like) { if (isAlwayTrueLikePattern(x.getRight())) { - final WallSelectQueryContext wallSelectQueryContext = WallVisitorUtils.getWallSelectQueryContext(); - if (wallSelectQueryContext != null) { - wallSelectQueryContext.setTrueLike(Boolean.TRUE); - } + x.putAttribute(WallVisitorUtils.HAS_TRUE_LIKE, Boolean.TRUE); x.putAttribute(EVAL_VALUE, Boolean.TRUE); return false; } } if (x.getOperator() == SQLBinaryOperator.NotLike) { - if (isAlwayTrueLikePattern(x)) { + if (isAlwayTrueLikePattern(x.getRight())) { x.putAttribute(EVAL_VALUE, Boolean.FALSE); return false; } @@ -1063,7 +1059,7 @@ public class SQLEvalVisitorUtils { if (x instanceof SQLCharExpr) { String text = ((SQLCharExpr) x).getText(); - if (text.length() >= 0) { + if (text.length() > 0) { for (char ch : text.toCharArray()) { if (ch != '%') { return false; diff --git a/src/main/java/com/alibaba/druid/stat/DruidStatManagerFacade.java b/src/main/java/com/alibaba/druid/stat/DruidStatManagerFacade.java index 8e0f59139f..2824469f1c 100644 --- a/src/main/java/com/alibaba/druid/stat/DruidStatManagerFacade.java +++ b/src/main/java/com/alibaba/druid/stat/DruidStatManagerFacade.java @@ -34,9 +34,9 @@ import com.alibaba.druid.sql.visitor.SQLEvalVisitorUtils; import com.alibaba.druid.support.http.stat.WebAppStatManager; import com.alibaba.druid.support.spring.stat.SpringStatManager; import com.alibaba.druid.util.DruidDataSourceUtils; -import com.alibaba.druid.util.Utils; import com.alibaba.druid.util.JdbcSqlStatUtils; import com.alibaba.druid.util.StringUtils; +import com.alibaba.druid.util.Utils; /** * 监控相关的对外数据暴露 @@ -245,7 +245,7 @@ public final class DruidStatManagerFacade { } else if (valueA instanceof List && valueB instanceof List) { List> mergedList = mergeNamedList((List) valueA, (List) valueB); newMap.put(key, mergedList); - } else if (valueA instanceof String && valueB instanceof String && valueA.equals(valueB)) { + } else if (valueA instanceof String && valueB instanceof String) { newMap.put(key, valueA); } else { Object sum = SQLEvalVisitorUtils.add(valueA, valueB); diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 87d840d5cb..ac92c6ec44 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -39,6 +39,7 @@ public class WallConfig implements WallConfigMBean { private boolean conditionAndAlwayTrueAllow = false; private boolean conditionDoubleConstAllow = false; + private boolean conditionLikeTrueAllow = false; private boolean selectAllColumnAllow = true; @@ -58,7 +59,7 @@ public class WallConfig implements WallConfigMBean { private boolean setAllow = true; private boolean commitAllow = true; private boolean rollbackAllow = true; - private boolean useAllow = false; + private boolean useAllow = true; private boolean multiStatementAllow = false; @@ -130,6 +131,14 @@ public class WallConfig implements WallConfigMBean { this.conditionDoubleConstAllow = conditionDoubleConstAllow; } + public boolean isConditionLikeTrueAllow() { + return conditionLikeTrueAllow; + } + + public void setConditionLikeTrueAllow(boolean conditionLikeTrueAllow) { + this.conditionLikeTrueAllow = conditionLikeTrueAllow; + } + public boolean isLimitZeroAllow() { return limitZeroAllow; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 9c6182419e..59083daf87 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -22,6 +22,7 @@ import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.net.URL; +import java.util.ArrayList; import java.util.Collections; import java.util.Enumeration; import java.util.List; @@ -117,7 +118,9 @@ import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; public class WallVisitorUtils { - private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class); + private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class); + + public final static String HAS_TRUE_LIKE = "hasTrueLike"; public static void check(WallVisitor visitor, SQLInListExpr x) { @@ -223,98 +226,52 @@ public class WallVisitorUtils { public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) { - final WallSelectQueryContext old = wallSelectQueryContextLocal.get(); - try { - wallSelectQueryContextLocal.set(new WallSelectQueryContext()); + for (SQLSelectItem item : x.getSelectList()) { + item.setParent(x); + } - for (SQLSelectItem item : x.getSelectList()) { - item.setParent(x); - } + if (x.getInto() != null) { + checkReadOnly(visitor, x.getInto()); + } - if (x.getInto() != null) { - checkReadOnly(visitor, x.getInto()); - } + if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) { + addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x); + return; + } - if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) { - addViolation(visitor, ErrorCode.SELECT_INTO_NOT_ALLOW, "select into not allow", x); - return; - } + if (x.getFrom() != null) { + x.getFrom().setParent(x); + } - if (x.getFrom() != null) { - x.getFrom().setParent(x); - } + SQLExpr where = x.getWhere(); + if (where != null) { + where.setParent(x); + checkCondition(visitor, x.getWhere()); - SQLExpr where = x.getWhere(); - if (where != null) { - where.setParent(x); - checkCondition(visitor, x.getWhere()); + Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); - Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); + if (Boolean.TRUE == whereValue) { + if (queryBlockFromIsNull(visitor, x, false)) { + addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x); + } - if (Boolean.TRUE == whereValue) { - if (queryBlockFromIsNull(visitor, x, false)) { - addViolation(visitor, ErrorCode.EMPTY_QUERY_HAS_CONDITION, "empty select has condition", x); - } - - boolean isSimpleConstExpr = false; - SQLExpr first = getFirst(where); - - if (first == where || first instanceof SQLLiteralExpr) { - isSimpleConstExpr = true; - } else if (first instanceof SQLBinaryOpExpr) { - SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first; - - if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality - || binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) { - if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr - && binaryOpExpr.getRight() instanceof SQLIntegerExpr) { - isSimpleConstExpr = true; - } - } - } - - final WallSelectQueryContext current = wallSelectQueryContextLocal.get(); - if (!isSimpleConstExpr // 简单表达式 - && !(current != null && current.hasTrueLike()) // eg: like '%%' - ) { - addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x); - } + if (!isSimpleConstExpr(where)) {// 简单表达式 + addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x); } } - checkConditionForMultiTenant(visitor, x.getWhere(), x); - } finally { - wallSelectQueryContextLocal.set(old); } + checkConditionForMultiTenant(visitor, x.getWhere(), x); } public static void checkHaving(WallVisitor visitor, SQLExpr x) { if (x == null) { return; } - final WallSelectQueryContext old = wallSelectQueryContextLocal.get(); - try { - wallSelectQueryContextLocal.set(new WallSelectQueryContext()); - if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { - boolean isSimpleConstExpr = false; - if (x instanceof SQLBinaryOpExpr) { - SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) x; - if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality - || binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) { - if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr - && binaryOpExpr.getRight() instanceof SQLIntegerExpr) { - isSimpleConstExpr = true; - } - } - } - - final WallSelectQueryContext current = wallSelectQueryContextLocal.get(); - if (!isSimpleConstExpr && !(current != null && current.hasTrueLike())) { - addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x); - } + if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { + if (!isSimpleConstExpr(x)) { + addViolation(visitor, ErrorCode.ALWAY_TRUE, "having alway true condition not allow", x); } - } finally { - wallSelectQueryContextLocal.set(old); } } @@ -351,24 +308,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) { - boolean isSimpleConstExpr = false; - SQLExpr first = getFirst(where); - - if (first == where) { - isSimpleConstExpr = true; - } else if (first instanceof SQLBinaryOpExpr) { - SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first; - - if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality - || binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) { - if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr - && binaryOpExpr.getRight() instanceof SQLIntegerExpr) { - isSimpleConstExpr = true; - } - } - } - - if (!isSimpleConstExpr) { + if (!isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAY_TRUE, "delete alway true condition not allow", x); } } @@ -377,6 +317,36 @@ public class WallVisitorUtils { checkConditionForMultiTenant(visitor, x.getWhere(), x); } + private static boolean isSimpleConstExpr(SQLExpr sqlExpr) { + List parts = getParts(sqlExpr); + if (parts.isEmpty()) { + return false; + } + + for (SQLExpr part : parts) { + boolean isSimpleConstExpr = false; + if (part == sqlExpr || part instanceof SQLLiteralExpr) { + isSimpleConstExpr = true; + } else if (part instanceof SQLBinaryOpExpr) { + SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) part; + + if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality + || binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual + || binaryOpExpr.getOperator() == SQLBinaryOperator.GreaterThan) { + if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr + && binaryOpExpr.getRight() instanceof SQLIntegerExpr) { + isSimpleConstExpr = true; + } + } + } + + if (!isSimpleConstExpr) { + return false; + } + } + return true; + } + private static void checkCondition(WallVisitor visitor, SQLExpr x) { if (x == null) { return; @@ -584,24 +554,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) { - boolean isSimpleConstExpr = false; - SQLExpr first = getFirst(where); - - if (first == where) { - isSimpleConstExpr = true; - } else if (first instanceof SQLBinaryOpExpr) { - SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first; - - if (binaryOpExpr.getOperator() == SQLBinaryOperator.Equality - || binaryOpExpr.getOperator() == SQLBinaryOperator.NotEqual) { - if (binaryOpExpr.getLeft() instanceof SQLIntegerExpr - && binaryOpExpr.getRight() instanceof SQLIntegerExpr) { - isSimpleConstExpr = true; - } - } - } - - if (!isSimpleConstExpr) { + if (!isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAY_TRUE, "update alway true condition not allow", x); } } @@ -741,7 +694,7 @@ public class WallVisitorUtils { dbType = wallContext.getDbType(); } - return eval(dbType, x, Collections.emptyList()); + return eval(visitor, dbType, x, Collections.emptyList()); } public static SQLExpr getFirst(SQLExpr x) { @@ -756,6 +709,23 @@ public class WallVisitorUtils { return x; } + public static List getParts(SQLExpr x) { + List exprs = new ArrayList(); + + if (x instanceof SQLBinaryOpExpr) { + SQLBinaryOpExpr binary = (SQLBinaryOpExpr) x; + if (binary.getOperator() == SQLBinaryOperator.BooleanAnd + || binary.getOperator() == SQLBinaryOperator.BooleanOr) { + exprs.addAll(getParts(((SQLBinaryOpExpr) x).getLeft())); + exprs.addAll(getParts(((SQLBinaryOpExpr) x).getRight())); + return exprs; + } + } + + exprs.add(x); + return exprs; + } + public static boolean isFirst(SQLObject x) { if (x == null) { return true; @@ -844,19 +814,6 @@ public class WallVisitorUtils { } } - public static class WallSelectQueryContext { - - private boolean trueLike = false; - - public boolean hasTrueLike() { - return trueLike; - } - - public void setTrueLike(boolean trueLike) { - this.trueLike = trueLike; - } - } - public static class WallTopStatementContext { private boolean fromSysTable = false; @@ -931,7 +888,6 @@ public class WallVisitorUtils { } private static ThreadLocal wallConditionContextLocal = new ThreadLocal(); - private static ThreadLocal wallSelectQueryContextLocal = new ThreadLocal(); private static ThreadLocal wallTopStatementContextLocal = new ThreadLocal(); public static WallConditionContext getWallConditionContext() { @@ -950,10 +906,6 @@ public class WallVisitorUtils { wallTopStatementContextLocal.set(new WallTopStatementContext()); } - public static WallSelectQueryContext getWallSelectQueryContext() { - return wallSelectQueryContextLocal.get(); - } - public static Object getConditionValue(WallVisitor visitor, SQLExpr x, boolean alwayTrueCheck) { final WallConditionContext old = wallConditionContextLocal.get(); try { @@ -992,13 +944,25 @@ public class WallVisitorUtils { } } + public static Object getValueFromAttributes(WallVisitor visitor, SQLObject sqlObject) { + if (sqlObject == null) { + return null; + } + + if (visitor != null && visitor.getConfig().isConditionLikeTrueAllow() + && sqlObject.getAttributes().containsKey(HAS_TRUE_LIKE)) { + return null; + } + return sqlObject.getAttribute(EVAL_VALUE); + } + public static Object getValue(SQLExpr x) { return getValue(null, x); } public static Object getValue(WallVisitor visitor, SQLExpr x) { if (x != null && x.getAttributes().containsKey(EVAL_VALUE)) { - return x.getAttribute(EVAL_VALUE); + return getValueFromAttributes(visitor, x); } if (x instanceof SQLBinaryOpExpr) { @@ -1044,7 +1008,7 @@ public class WallVisitorUtils { || x instanceof SQLInListExpr // || x instanceof SQLUnaryExpr // ) { - return eval(dbType, x, Collections.emptyList()); + return eval(visitor, dbType, x, Collections.emptyList()); } if (visitor != null && (!visitor.getConfig().isCaseConditionAllow()) && x instanceof SQLCaseExpr) { @@ -1067,20 +1031,22 @@ public class WallVisitorUtils { } } - return eval(dbType, x, Collections.emptyList()); + return eval(visitor, dbType, x, Collections.emptyList()); } return null; } - public static Object eval(String dbType, SQLObject sqlObject, List parameters) { + public static Object eval(WallVisitor wallVisitor, String dbType, SQLObject sqlObject, List parameters) { SQLEvalVisitor visitor = SQLEvalVisitorUtils.createEvalVisitor(dbType); visitor.setParameters(parameters); visitor.registerFunction("rand", Nil.instance); sqlObject.accept(visitor); - Object value = SQLEvalVisitorUtils.getValue(sqlObject); - return value; + if (sqlObject instanceof SQLNumericLiteralExpr) { + return ((SQLNumericLiteralExpr) sqlObject).getNumber(); + } + return getValueFromAttributes(wallVisitor, sqlObject); } public static boolean isSimpleCountTableSource(WallVisitor visitor, SQLTableSource tableSource) { @@ -1260,7 +1226,7 @@ public class WallVisitorUtils { owner = WallVisitorUtils.form(owner); if (isInTableSource(x) && !visitor.getProvider().checkDenySchema(owner)) { - if (!isTopUpdateStatement(x) && !isFirstSelectTableSource(x)) { + if (!isTopUpdateStatement(x) && !isFirstSelectTableSource(x) && !isFirstInSubQuery(x)) { SQLObject parent = x.getParent(); while (parent != null && !(parent instanceof SQLStatement)) { parent = parent.getParent(); @@ -1335,6 +1301,60 @@ public class WallVisitorUtils { return false; } + private static boolean isFirstInSubQuery(SQLObject x) { + for (;;) { + if (x instanceof SQLExpr) { + x = x.getParent(); + } else { + break; + } + } + + if (!(x instanceof SQLExprTableSource)) { + return false; + } + + SQLSelect sqlSelect = null; + SQLObject parent = x.getParent(); + while (parent != null) { + + if (parent instanceof SQLSelect) { + sqlSelect = (SQLSelect) parent; + break; + } + + x = parent; + parent = x.getParent(); + } + + if (sqlSelect == null) { + return false; + } + + parent = sqlSelect.getParent(); + if (!(parent instanceof SQLInSubQueryExpr && isFirst(parent))) { + return false; + } + + SQLInSubQueryExpr sqlInSubQueryExpr = (SQLInSubQueryExpr) parent; + if (!(sqlInSubQueryExpr.getParent() instanceof SQLSelectQueryBlock)) { + return false; + } + + SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) sqlInSubQueryExpr.getParent(); + if (!(queryBlock.getParent() instanceof SQLSelect)) { + return false; + } + + SQLSelect select = (SQLSelect) queryBlock.getParent(); + if (!(select.getParent() instanceof SQLSelectStatement)) { + return false; + } + + SQLSelectStatement stmt = (SQLSelectStatement) select.getParent(); + return stmt.getParent() == null; + } + private static boolean isFirstSelectTableSource(SQLObject x) { for (;;) { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest142.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest142.java index 33eae0a13f..939694b420 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest142.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest142.java @@ -27,7 +27,7 @@ public class MySqlWallTest142 extends TestCase { public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); - String sql = "SELECT * FROM `my_crons` WHERE 1 OR nextrun = '0' "; + String sql = "SELECT * FROM `my_crons` WHERE 1 AND nextrun = '0' "; Assert.assertTrue(provider.checkValid(sql)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java index f6816afb9b..efd3c01fd4 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -44,6 +44,7 @@ public class MySqlWallTest91 extends TestCase { provider.getConfig().setLimitZeroAllow(true); provider.getConfig().setCommentAllow(true); provider.getConfig().setConditionDoubleConstAllow(true); + provider.getConfig().setConditionLikeTrueAllow(true); return provider; } @@ -160,6 +161,14 @@ public class MySqlWallTest91 extends TestCase { } } + public void test_true5() { + WallProvider provider = initWallProvider(); + { + String sql = "select * from view_featureWarm where 1 = 1 and MaterialID in (select Materialid from material where Code like '%%' and name like '%%' and specs like '%%') and sumbalcqty <> 0"; + Assert.assertTrue(provider.checkValid(sql)); + } + } + public void test_true() throws Exception { WallProvider provider = initWallProvider(); { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java index ba6a2707a3..b36c650590 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest_0.java @@ -44,6 +44,7 @@ public class SQLServerWallTest_0 extends TestCase { provider.getConfig().setLimitZeroAllow(true); provider.getConfig().setCommentAllow(true); provider.getConfig().setConditionDoubleConstAllow(true); + provider.getConfig().setConditionLikeTrueAllow(true); return provider; } @@ -136,6 +137,22 @@ public class SQLServerWallTest_0 extends TestCase { } } + public void test_true6() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select count(1) from [Tiger_Help] where 1 = 1 and id = 1"; + Assert.assertTrue(provider.checkValid(sql)); + } + } + + public void test_true7() throws Exception { + WallProvider provider = initWallProvider(); + { + String sql = "select objjc,objname,pwd,servadd from wfp..wfpsys_user where objname in(select name from master..sysdatabases) "; + Assert.assertTrue(provider.checkValid(sql)); + } + } + public void test_true() throws Exception { WallProvider provider = initWallProvider(); { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java index cd21ea8523..c51c9b15ff 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest0.java @@ -23,16 +23,17 @@ import com.alibaba.druid.wall.WallUtils; /** * 这个场景，检测可疑的Having条件 + * * @author wenshao - * */ public class WallSelectWhereTest0 extends TestCase { - private String sql = "SELECT F1, F2 from t WHERE 1 = 1 OR F1 = ?"; + + private String sql = "SELECT F1, F2 from t WHERE 1 = 1 AND F1 = ?"; public void testMySql() throws Exception { Assert.assertTrue(WallUtils.isValidateMySql(sql)); } - + public void testORACLE() throws Exception { Assert.assertTrue(WallUtils.isValidateOracle(sql)); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java index 81ce62924b..35377292ed 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java @@ -23,24 +23,24 @@ import com.alibaba.druid.wall.WallUtils; /** * 这个场景，检测可疑的Having条件 + * * @author wenshao - * */ public class WallSelectWhereTest1 extends TestCase { public void testMySql_true() throws Exception { - Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?")); + Assert.assertTrue(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ?")); } - + public void testORACLE_true() throws Exception { - Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 OR FID = ?")); + Assert.assertTrue(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ?")); } - + public void testMySql_false() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ? OR 1 = 1")); } - + public void testORACLE_false() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE FID = ? OR 1 = 1")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT F1, F2 from t WHERE 1 = 1 AND FID = ? OR 1 = 1")); } } From 65d93d35a7ebde2fd1eec4a1d02672dc32955fc2 Mon Sep 17 00:00:00 2001 From: kiki Date: Tue, 10 Sep 2013 14:30:18 +0800 Subject: [PATCH 2/2] modify druid version --- pom.xml | 2 +- src/main/java/com/alibaba/druid/VERSION.java | 4 ++-- .../alibaba/druid/bvt/filter/wall/MySqlWallTest40.java | 10 +++++----- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 129e61df6b..b80a7eb8f2 100644 --- a/pom.xml +++ b/pom.xml @@ -11,7 +11,7 @@ com.alibaba druid - 0.2.26 + 0.2.27 jar druid diff --git a/src/main/java/com/alibaba/druid/VERSION.java b/src/main/java/com/alibaba/druid/VERSION.java index 8291983bfa..a50fcf20f6 100644 --- a/src/main/java/com/alibaba/druid/VERSION.java +++ b/src/main/java/com/alibaba/druid/VERSION.java @@ -19,8 +19,8 @@ public final class VERSION { public final static int MajorVersion = 0; public final static int MinorVersion = 2; - public final static int RevisionVersion = 26; - + public final static int RevisionVersion = 27; + public static String getVersionNumber() { return VERSION.MajorVersion + "." + VERSION.MinorVersion + "." + VERSION.RevisionVersion; } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java index d06bdcfb45..3e64d4a3d1 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest40.java @@ -33,20 +33,20 @@ public class MySqlWallTest40 extends TestCase { public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setUseAllow(false); Assert.assertFalse(provider.checkValid(// "use huaianapp")); // Assert.assertEquals(0, provider.getTableStats().size()); } - + public void test_true() throws Exception { WallProvider provider = new MySqlWallProvider(); - provider.getConfig().setUseAllow(true); - + Assert.assertTrue(provider.checkValid(// - "use huaianapp")); // - + "use huaianapp")); // + Assert.assertEquals(0, provider.getTableStats().size()); } }