diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java index 444a2e1992..6cf790d56f 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java @@ -9,6 +9,8 @@ import com.alibaba.druid.filter.wall.spi.WallVisitorUtils; public class WallConfig { + private boolean noneBaseStatementAllow = false; + private boolean selelctAllow = true; private boolean selectIntoAllow = true; private boolean selectIntoOutfileAllow = false; @@ -25,6 +27,8 @@ public class WallConfig { private boolean insertAllow = true; private boolean mergeAllow = true; + private boolean truncateAllow = false; + private boolean shcemaCheck = true; private boolean tableCheck = true; private boolean functionCheck = true; @@ -76,6 +80,22 @@ public class WallConfig { loadResource(getPermitObjects(), dir + "/permit-object.txt"); } + public boolean isNoneBaseStatementAllow() { + return noneBaseStatementAllow; + } + + public void setNoneBaseStatementAllow(boolean noneBaseStatementAllow) { + this.noneBaseStatementAllow = noneBaseStatementAllow; + } + + public boolean isTruncateAllow() { + return truncateAllow; + } + + public void setTruncateAllow(boolean truncateAllow) { + this.truncateAllow = truncateAllow; + } + public boolean isSelelctAllow() { return selelctAllow; } diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/WallVisitor.java index 035fb94ada..db434abf60 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallVisitor.java @@ -11,7 +11,7 @@ public interface WallVisitor extends SQLASTVisitor { List getViolations(); - boolean containsPermitTable(String name); + boolean isPermitTable(String name); String toSQL(SQLObject obj); } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java index 13ad073f67..7608428884 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java @@ -22,6 +22,7 @@ import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; +import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr; @@ -142,7 +143,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } if (varName.startsWith("@@")) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } return false; @@ -168,7 +169,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(MySqlOutFileExpr x) { if (!config.isSelectIntoOutfileAllow()) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } return true; @@ -187,7 +188,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } @Override - public boolean containsPermitTable(String name) { + public boolean isPermitTable(String name) { if (!config.isTableCheck()) { return false; } @@ -200,6 +201,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi if (!(x instanceof SQLStatement)) { return; } + + if (config.isNoneBaseStatementAllow()) { + return; + } if (x instanceof SQLInsertStatement) { @@ -208,9 +213,13 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } else if (x instanceof SQLDeleteStatement) { } else if (x instanceof SQLUpdateStatement) { - + + } else if (x instanceof SQLTruncateStatement) { + if (!config.isTruncateAllow()) { + violations.add(new IllegalSQLObjectViolation(toSQL(x))); + } } else { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java index 632a50682d..118d54de2d 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java @@ -16,12 +16,12 @@ import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr; import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; -import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement; import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; +import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement; @@ -65,11 +65,6 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi return true; } - public boolean visit(SQLDropTableStatement x) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toOracleString(x))); - return false; - } - @Override public boolean visit(SQLMethodInvokeExpr x) { WallVisitorUtils.checkFunction(this, x); @@ -124,7 +119,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi } @Override - public boolean containsPermitTable(String name) { + public boolean isPermitTable(String name) { if (!config.isTableCheck()) { return false; } @@ -141,6 +136,10 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi return; } + if (config.isNoneBaseStatementAllow()) { + return; + } + if (x instanceof SQLInsertStatement) { } else if (x instanceof SQLSelectStatement) { @@ -149,10 +148,13 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi } else if (x instanceof SQLUpdateStatement) { } else if (x instanceof OracleMultiInsertStatement) { - } else if (x instanceof OracleMergeStatement) { + } else if (x instanceof SQLTruncateStatement) { + if (!config.isTruncateAllow()) { + violations.add(new IllegalSQLObjectViolation(toSQL(x))); + } } else { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java index 5dfec83492..cc14809ceb 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java @@ -12,9 +12,9 @@ import com.alibaba.druid.filter.wall.IllegalSQLObjectViolation; import com.alibaba.druid.filter.wall.WallVisitor; import com.alibaba.druid.logging.Log; import com.alibaba.druid.logging.LogFactory; -import com.alibaba.druid.sql.SQLUtils; import com.alibaba.druid.sql.ast.SQLExpr; import com.alibaba.druid.sql.ast.SQLName; +import com.alibaba.druid.sql.ast.SQLObject; import com.alibaba.druid.sql.ast.expr.SQLAggregateExpr; import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr; import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; @@ -51,14 +51,14 @@ public class WallVisitorUtils { String owner = x.getOwner().toString(); owner = WallVisitorUtils.form(owner); if (visitor.getConfig().isPermitObjects(owner)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } } public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) { if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } @@ -79,7 +79,7 @@ public class WallVisitorUtils { } } - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -93,13 +93,13 @@ public class WallVisitorUtils { } if (Boolean.TRUE == getValue(x)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } public static void checkDelete(WallVisitor visitor, SQLDeleteStatement x) { if (!visitor.getConfig().isDeleteAllow()) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } @@ -108,13 +108,13 @@ public class WallVisitorUtils { } if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } public static void checkUpdate(WallVisitor visitor, SQLUpdateStatement x) { if (!visitor.getConfig().isUpdateAllow()) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } @@ -123,7 +123,7 @@ public class WallVisitorUtils { } if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -399,7 +399,7 @@ public class WallVisitorUtils { String owner = x.getOwner().toString(); owner = WallVisitorUtils.form(owner); if (visitor.getConfig().isPermitObjects(owner)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -410,7 +410,7 @@ public class WallVisitorUtils { String methodName = x.getMethodName(); if (visitor.getConfig().isPermitFunction(methodName.toLowerCase())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -428,7 +428,7 @@ public class WallVisitorUtils { ownerName = form(ownerName); if (visitor.getConfig().getPermitSchemas().contains(ownerName.toLowerCase())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -441,19 +441,23 @@ public class WallVisitorUtils { if (tableName != null) { tableName = form(tableName); - if (visitor.containsPermitTable(tableName)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + if (visitor.isPermitTable(tableName)) { + addViolation(visitor, x); } } } + private static void addViolation(WallVisitor visitor, SQLObject x) { + visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + } + public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) { if (!visitor.getConfig().isSelectUnionCheck()) { return; } if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + addViolation(visitor, x); } } diff --git a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleExceptionStatement.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleExceptionStatement.java index 76165444ea..b02436a002 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleExceptionStatement.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleExceptionStatement.java @@ -8,7 +8,7 @@ import com.alibaba.druid.sql.ast.SQLStatement; import com.alibaba.druid.sql.dialect.oracle.ast.OracleSQLObjectImpl; import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVisitor; -public class OracleExceptionStatement extends OracleSQLObjectImpl implements OracleStatement { +public class OracleExceptionStatement extends OracleStatementImpl implements OracleStatement { private static final long serialVersionUID = 1L; private List items = new ArrayList(); diff --git a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleGrantStatement.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleGrantStatement.java index 73eeec0c85..b321f7fa07 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleGrantStatement.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/ast/stmt/OracleGrantStatement.java @@ -4,10 +4,9 @@ import java.util.ArrayList; import java.util.List; import com.alibaba.druid.sql.ast.SQLExpr; -import com.alibaba.druid.sql.dialect.oracle.ast.OracleSQLObjectImpl; import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVisitor; -public class OracleGrantStatement extends OracleSQLObjectImpl implements OracleStatement { +public class OracleGrantStatement extends OracleStatementImpl implements OracleStatement { private static final long serialVersionUID = 1L; diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java new file mode 100644 index 0000000000..7f15a29bfa --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java @@ -0,0 +1,32 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测 + * @author wenshao + * + */ +public class WallDropTest1 extends TestCase { + private String sql = "DROP TABLE T1"; + + private WallConfig config = new WallConfig(); + + protected void setUp() throws Exception { + config.setNoneBaseStatementAllow(true); + } + + public void testMySql() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + } + + public void testORACLE() throws Exception { + + Assert.assertTrue(WallUtils.isValidateOracle(sql, config)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest.java new file mode 100644 index 0000000000..45b834c498 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest.java @@ -0,0 +1,32 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测 + * @author wenshao + * + */ +public class WallTruncateTest extends TestCase { + private String sql = "TRUNCATE TABLE T1"; + + private WallConfig config = new WallConfig(); + + protected void setUp() throws Exception { + //config.setTruncateAllow(true); + } + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + } + + public void testORACLE() throws Exception { + + Assert.assertFalse(WallUtils.isValidateOracle(sql, config)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest1.java new file mode 100644 index 0000000000..95260b5ecb --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallTruncateTest1.java @@ -0,0 +1,32 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测 + * @author wenshao + * + */ +public class WallTruncateTest1 extends TestCase { + private String sql = "TRUNCATE TABLE T1"; + + private WallConfig config = new WallConfig(); + + protected void setUp() throws Exception { + config.setTruncateAllow(true); + } + + public void testMySql() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + } + + public void testORACLE() throws Exception { + + Assert.assertTrue(WallUtils.isValidateOracle(sql, config)); + } +}