sql wall

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitObjectTest.java

@@ -16,6 +16,7 @@ public class OracleWallPermitObjectTest extends TestCase {
     public void test_permitTable() throws Exception {
         Assert.assertFalse(WallUtils.isValidateOracle("select utl_inaddr.get_host_address from DUAL"));
         Assert.assertFalse(WallUtils.isValidateOracle("select TO_CHAR(utl_inaddr.get_host_address) from DUAL"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT'.PUT(:P1));"));
     }
     
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallHavingTest extends TestCase {
+    private String sql = "SELECT F1, COUNT(*) FROM T GROUP BY F1 HAVING 1 = 1";
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java

@@ -0,0 +1,23 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，被攻击者用于测试当前SQL拥有多少字段
+ * @author wenshao
+ *
+ */
+public class WallUnionTest4 extends TestCase {
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)"));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)"));
+    }
+}