Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge branch 'master' of https://github.com/wenshao/druid

Browse Source
This commit is contained in:
wenshao
2014-01-01 18:59:17 +08:00
parent 0d15cca020 59d357aff2
commit df179b2e21
11 changed files with 186 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pom.xml
+1 -1
View File
@@ -11,7 +11,7 @@
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>0.2.27-SNAPSHOT</version>
<version>1.0.2-SNAPSHOT</version>
<packaging>jar</packaging>
<name>druid</name>
src/main/java/com/alibaba/druid/VERSION.java
+3 -3
View File
@@ -17,9 +17,9 @@ package com.alibaba.druid;
public final class VERSION {
public final static int MajorVersion = 0;
public final static int MinorVersion = 2;
public final static int RevisionVersion = 27;
public final static int MajorVersion = 1;
public final static int MinorVersion = 0;
public final static int RevisionVersion = 2;
public static String getVersionNumber() {
return VERSION.MajorVersion + "." + VERSION.MinorVersion + "." + VERSION.RevisionVersion;
src/main/java/com/alibaba/druid/pool/DruidDataSource.java
+1 -1
View File
@@ -1065,7 +1065,7 @@ public class DruidDataSource extends DruidAbstractDataSource implements DruidDat
String errorMessage = buf.toString();
if (this.createError == null) {
if (this.createError != null) {
throw new GetConnectionTimeoutException(errorMessage, createError);
} else {
throw new GetConnectionTimeoutException(errorMessage);
src/main/java/com/alibaba/druid/sql/SQLUtils.java
+2 -1
View File
@@ -310,6 +310,8 @@ public class SQLUtils {
public static List<SQLExpr> split(SQLBinaryOpExpr x) {
List<SQLExpr> groupList = new ArrayList<SQLExpr>();
groupList.add(x.getRight());
SQLExpr left = x.getLeft();
for (;;) {
if (left instanceof SQLBinaryOpExpr && ((SQLBinaryOpExpr) left).getOperator() == x.getOperator()) {
@@ -321,7 +323,6 @@ public class SQLUtils {
break;
}
}
groupList.add(x.getRight());
return groupList;
}
}
src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
+6
View File
@@ -854,6 +854,12 @@ public class SQLEvalVisitorUtils {
wallConditionContext.setPartAlwayTrue(true);
}
}
} else if (x.getOperator() == SQLBinaryOperator.BooleanAnd) {
if (wallConditionContext != null) {
if (left.getAttribute(EVAL_VALUE) == Boolean.FALSE || right.getAttribute(EVAL_VALUE) == Boolean.FALSE) {
wallConditionContext.setPartAlwayFalse(true);
}
}
} else if (x.getOperator() == SQLBinaryOperator.BooleanXor) {
if (wallConditionContext != null) {
wallConditionContext.setXor(true);
src/main/java/com/alibaba/druid/wall/WallConfig.java
+76 -67
View File
@@ -24,80 +24,81 @@ import com.alibaba.druid.wall.spi.WallVisitorUtils;
public class WallConfig implements WallConfigMBean {
private boolean noneBaseStatementAllow = false;
private boolean noneBaseStatementAllow = false;
private boolean callAllow = true;
private boolean selelctAllow = true;
private boolean selectIntoAllow = true;
private boolean selectIntoOutfileAllow = false;
private boolean selectWhereAlwayTrueCheck = true;
private boolean selectHavingAlwayTrueCheck = true;
private boolean selectUnionCheck = true;
private boolean selectMinusCheck = true;
private boolean selectExceptCheck = true;
private boolean selectIntersectCheck = true;
private boolean createTableAllow = true;
private boolean dropTableAllow = true;
private boolean alterTableAllow = true;
private boolean callAllow = true;
private boolean selelctAllow = true;
private boolean selectIntoAllow = true;
private boolean selectIntoOutfileAllow = false;
private boolean selectWhereAlwayTrueCheck = true;
private boolean selectHavingAlwayTrueCheck = true;
private boolean selectUnionCheck = true;
private boolean selectMinusCheck = true;
private boolean selectExceptCheck = true;
private boolean selectIntersectCheck = true;
private boolean createTableAllow = true;
private boolean dropTableAllow = true;
private boolean alterTableAllow = true;
private boolean conditionAndAlwayTrueAllow = false;
private boolean conditionDoubleConstAllow = false;
private boolean conditionLikeTrueAllow = true;
private boolean conditionAndAlwayTrueAllow = false;
private boolean conditionAndAlwayFalseAllow = false;
private boolean conditionDoubleConstAllow = false;
private boolean conditionLikeTrueAllow = true;
private boolean selectAllColumnAllow = true;
private boolean selectAllColumnAllow = true;
private boolean deleteAllow = true;
private boolean deleteWhereAlwayTrueCheck = true;
private boolean deleteWhereNoneCheck = false;
private boolean deleteAllow = true;
private boolean deleteWhereAlwayTrueCheck = true;
private boolean deleteWhereNoneCheck = false;
private boolean updateAllow = true;
private boolean updateWhereAlayTrueCheck = true;
private boolean updateWhereNoneCheck = false;
private boolean updateAllow = true;
private boolean updateWhereAlayTrueCheck = true;
private boolean updateWhereNoneCheck = false;
private boolean insertAllow = true;
private boolean mergeAllow = true;
private boolean minusAllow = true;
private boolean intersectAllow = true;
private boolean replaceAllow = true;
private boolean setAllow = true;
private boolean commitAllow = true;
private boolean rollbackAllow = true;
private boolean useAllow = true;
private boolean insertAllow = true;
private boolean mergeAllow = true;
private boolean minusAllow = true;
private boolean intersectAllow = true;
private boolean replaceAllow = true;
private boolean setAllow = true;
private boolean commitAllow = true;
private boolean rollbackAllow = true;
private boolean useAllow = true;
private boolean multiStatementAllow = false;
private boolean multiStatementAllow = false;
private boolean truncateAllow = true;
private boolean truncateAllow = true;
private boolean commentAllow = false;
private boolean strictSyntaxCheck = true;
private boolean constArithmeticAllow = true;
private boolean limitZeroAllow = false;
private boolean commentAllow = false;
private boolean strictSyntaxCheck = true;
private boolean constArithmeticAllow = true;
private boolean limitZeroAllow = false;
private boolean describeAllow = true;
private boolean showAllow = true;
private boolean describeAllow = true;
private boolean showAllow = true;
private boolean schemaCheck = true;
private boolean tableCheck = true;
private boolean functionCheck = true;
private boolean objectCheck = true;
private boolean variantCheck = true;
private boolean schemaCheck = true;
private boolean tableCheck = true;
private boolean functionCheck = true;
private boolean objectCheck = true;
private boolean variantCheck = true;
private boolean mustParameterized = false;
private boolean mustParameterized = false;
private boolean doPrivilegedAllow = false;
private boolean doPrivilegedAllow = false;
protected final Set<String> denyFunctions = new ConcurrentSkipListSet<String>();
protected final Set<String> denyTables = new ConcurrentSkipListSet<String>();
protected final Set<String> denySchemas = new ConcurrentSkipListSet<String>();
protected final Set<String> denyVariants = new ConcurrentSkipListSet<String>();
protected final Set<String> denyObjects = new ConcurrentSkipListSet<String>();
protected final Set<String> denyFunctions = new ConcurrentSkipListSet<String>();
protected final Set<String> denyTables = new ConcurrentSkipListSet<String>();
protected final Set<String> denySchemas = new ConcurrentSkipListSet<String>();
protected final Set<String> denyVariants = new ConcurrentSkipListSet<String>();
protected final Set<String> denyObjects = new ConcurrentSkipListSet<String>();
protected final Set<String> permitFunctions = new ConcurrentSkipListSet<String>();
protected final Set<String> permitTables = new ConcurrentSkipListSet<String>();
protected final Set<String> permitSchemas = new ConcurrentSkipListSet<String>();
protected final Set<String> permitVariants = new ConcurrentSkipListSet<String>();
protected final Set<String> permitFunctions = new ConcurrentSkipListSet<String>();
protected final Set<String> permitTables = new ConcurrentSkipListSet<String>();
protected final Set<String> permitSchemas = new ConcurrentSkipListSet<String>();
protected final Set<String> permitVariants = new ConcurrentSkipListSet<String>();
protected final Set<String> readOnlyTables = new ConcurrentSkipListSet<String>();
protected final Set<String> readOnlyTables = new ConcurrentSkipListSet<String>();
private String dir;
@@ -106,24 +107,24 @@ public class WallConfig implements WallConfigMBean {
private String tenantTablePattern;
private String tenantColumn;
private boolean wrapAllow = true;
private boolean metadataAllow = true;
private boolean wrapAllow = true;
private boolean metadataAllow = true;
private boolean conditionOpXorAllow = false;
private boolean conditionOpBitwseAllow = true;
private boolean conditionOpXorAllow = false;
private boolean conditionOpBitwseAllow = true;
private boolean caseConditionAllow = false;
private boolean caseConditionConstAllow = false;
public WallConfig(){
}
public boolean isCaseConditionAllow() {
return caseConditionAllow;
public boolean isCaseConditionConstAllow() {
return caseConditionConstAllow;
}
public void setCaseConditionAllow(boolean caseConditionAllow) {
this.caseConditionAllow = caseConditionAllow;
public void setCaseConditionConstAllow(boolean caseConditionConstAllow) {
this.caseConditionConstAllow = caseConditionConstAllow;
}
public boolean isConditionDoubleConstAllow() {
@@ -158,6 +159,14 @@ public class WallConfig implements WallConfigMBean {
this.conditionAndAlwayTrueAllow = conditionAndAlwayTrueAllow;
}
public boolean isConditionAndAlwayFalseAllow() {
return conditionAndAlwayFalseAllow;
}
public void setConditionAndAlwayFalseAllow(boolean conditionAndAlwayFalseAllow) {
this.conditionAndAlwayFalseAllow = conditionAndAlwayFalseAllow;
}
public boolean isUseAllow() {
return useAllow;
}
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+9 -1
View File
@@ -65,6 +65,7 @@ import com.alibaba.druid.wall.WallContext;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallSqlTableStat;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.spi.WallVisitorUtils.WallTopStatementContext;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
@@ -310,6 +311,13 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
}
if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) {
final WallTopStatementContext topStatementContext = WallVisitorUtils.getWallTopStatementContext();
if (topStatementContext != null
&& (topStatementContext.fromSysSchema() || topStatementContext.fromSysTable())) {
return false;
}
boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x);
if (!isTop) {
boolean allow = true;
@@ -346,7 +354,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(MySqlOutFileExpr x) {
if (!config.isSelectIntoOutfileAllow()) {
if (!config.isSelectIntoOutfileAllow() && !WallVisitorUtils.isTopSelectOutFile(x)) {
violations.add(new IllegalSQLObjectViolation(ErrorCode.INTO_OUTFILE, "into out file not allow", toSQL(x)));
}
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+7
View File
@@ -53,6 +53,7 @@ import com.alibaba.druid.wall.Violation;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.WallVisitor;
import com.alibaba.druid.wall.spi.WallVisitorUtils.WallTopStatementContext;
import com.alibaba.druid.wall.violation.ErrorCode;
import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
@@ -254,6 +255,12 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
if (config.isVariantCheck() && varName.startsWith("@@")) {
final WallTopStatementContext topStatementContext = WallVisitorUtils.getWallTopStatementContext();
if (topStatementContext != null
&& (topStatementContext.fromSysSchema() || topStatementContext.fromSysTable())) {
return false;
}
boolean allow = true;
if (WallVisitorUtils.isWhereOrHaving(x) && isDeny(varName)) {
allow = false;
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+54 -13
View File
@@ -33,7 +33,6 @@ import com.alibaba.druid.sql.ast.SQLExpr;
import com.alibaba.druid.sql.ast.SQLName;
import com.alibaba.druid.sql.ast.SQLObject;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.alibaba.druid.sql.ast.SQLStatementImpl;
import com.alibaba.druid.sql.ast.expr.SQLAggregateExpr;
import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr;
import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
@@ -89,6 +88,7 @@ import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.ast.statement.SQLUseStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlBooleanExpr;
import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlCommitStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDeleteStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDescribeStatement;
@@ -205,7 +205,7 @@ public class WallVisitorUtils {
SQLExpr expr = x.getExpr();
if (expr instanceof SQLVariantRefExpr) {
if (!isTopSelectStatement(expr) && "@".equals(((SQLVariantRefExpr) expr).getName())) {
if (!isTopSelectItem(expr) && "@".equals(((SQLVariantRefExpr) expr).getName())) {
addViolation(visitor, ErrorCode.EVIL_NAME, "@ not allow", x);
}
}
@@ -650,6 +650,10 @@ public class WallVisitorUtils {
}
dalConst++;
} else if (Boolean.FALSE == booleanVal) {
final WallConditionContext wallContext = WallVisitorUtils.getWallConditionContext();
if (wallContext != null && !isFirst(item)) {
wallContext.setPartAlwayFalse(true);
}
allTrue = Boolean.FALSE;
dalConst++;
} else {
@@ -790,6 +794,14 @@ public class WallVisitorUtils {
return false;
}
if (parent instanceof SQLJoinTableSource) {
SQLJoinTableSource joinTableSource = (SQLJoinTableSource) parent;
if (joinTableSource.getCondition() == x) {
return true;
}
}
if (parent instanceof SQLUnionQuery) {
SQLUnionQuery union = (SQLUnionQuery) parent;
if (union.getRight() == x && hasWhere(union.getLeft())) {
@@ -869,17 +881,26 @@ public class WallVisitorUtils {
public static class WallConditionContext {
private boolean partAlwayrue;
private boolean partAlwayTrue = false;
private boolean partAlwayFalse = false;
private boolean constArithmetic = false;
private boolean xor = false;
private boolean bitwise = false;
public boolean hasPartAlwayTrue() {
return partAlwayrue;
return partAlwayTrue;
}
public void setPartAlwayTrue(boolean partAllowTrue) {
this.partAlwayrue = partAllowTrue;
this.partAlwayTrue = partAllowTrue;
}
public boolean hasPartAlwayFalse() {
return partAlwayFalse;
}
public void setPartAlwayFalse(boolean partAlwayFalse) {
this.partAlwayFalse = partAlwayFalse;
}
public boolean hasConstArithmetic() {
@@ -947,6 +968,10 @@ public class WallVisitorUtils {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "part alway true condition not allow", x);
}
if (current.hasPartAlwayFalse() && !visitor.getConfig().isConditionAndAlwayFalseAllow()) {
addViolation(visitor, ErrorCode.ALWAY_FALSE, "part alway false condition not allow", x);
}
if (current.hasConstArithmetic() && !visitor.getConfig().isConstArithmeticAllow()) {
addViolation(visitor, ErrorCode.CONST_ARITHMETIC, "const arithmetic not allow", x);
}
@@ -1025,7 +1050,7 @@ public class WallVisitorUtils {
Object result = getValue(caseExpr);
if (visitor != null && !visitor.getConfig().isCaseConditionAllow()) {
if (visitor != null && !visitor.getConfig().isCaseConditionConstAllow()) {
boolean leftIsName = false;
if (x.getParent() instanceof SQLBinaryOpExpr) {
SQLExpr left = ((SQLBinaryOpExpr) x.getParent()).getLeft();
@@ -1058,7 +1083,7 @@ public class WallVisitorUtils {
if (x instanceof SQLCaseExpr) {
if (visitor != null && !visitor.getConfig().isCaseConditionAllow()) {
if (visitor != null && !visitor.getConfig().isCaseConditionConstAllow()) {
SQLCaseExpr caseExpr = (SQLCaseExpr) x;
boolean leftIsName = false;
@@ -1476,6 +1501,7 @@ public class WallVisitorUtils {
}
boolean isWhereQueryExpr = false;
boolean isSelectItem = false;
do {
x = parent;
parent = parent.getParent();
@@ -1487,7 +1513,9 @@ public class WallVisitorUtils {
} else if (parent instanceof SQLQueryExpr || parent instanceof SQLInSubQueryExpr
|| parent instanceof SQLExistsExpr) {
isWhereQueryExpr = isWhereOrHaving(parent);
} else if (isWhereQueryExpr && parent instanceof SQLSelectQueryBlock) {
} else if (parent instanceof SQLSelectItem) {
isSelectItem = true;
} else if ((isWhereQueryExpr || isSelectItem) && parent instanceof SQLSelectQueryBlock) {
if (hasTableSource((SQLSelectQueryBlock) parent)) {
return false;
}
@@ -1548,7 +1576,7 @@ public class WallVisitorUtils {
if (x instanceof SQLExprTableSource) {
x = x.getParent();
if (x instanceof SQLStatementImpl) {
if (x instanceof SQLStatement) {
x = x.getParent();
if (x == null) {
return true;
@@ -1558,8 +1586,7 @@ public class WallVisitorUtils {
return false;
}
private static boolean isTopSelectStatement(SQLObject x) {
private static boolean isTopSelectItem(SQLObject x) {
for (;;) {
if ((x.getParent() instanceof SQLExpr) || (x.getParent() instanceof Item)) {
x = x.getParent();
@@ -1571,12 +1598,18 @@ public class WallVisitorUtils {
if (!(x.getParent() instanceof SQLSelectItem)) {
return false;
}
SQLSelectItem item = (SQLSelectItem) x.getParent();
if (!(item.getParent() instanceof SQLSelectQueryBlock)) {
return isTopSelectStatement(item.getParent());
}
private static boolean isTopSelectStatement(SQLObject x) {
if (!(x instanceof SQLSelectQueryBlock)) {
return false;
}
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) item.getParent();
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x;
if (!(queryBlock.getParent() instanceof SQLSelect)) {
return false;
}
@@ -1590,6 +1623,14 @@ public class WallVisitorUtils {
return stmt.getParent() == null;
}
public static boolean isTopSelectOutFile(MySqlOutFileExpr x) {
if (!(x.getParent() instanceof SQLExprTableSource)) {
return false;
}
SQLExprTableSource tableSource = (SQLExprTableSource) x.getParent();
return isTopSelectStatement(tableSource.getParent());
}
public static boolean check(WallVisitor visitor, SQLExprTableSource x) {
final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get();
src/main/java/com/alibaba/druid/wall/violation/ErrorCode.java
+1
View File
@@ -67,6 +67,7 @@ public interface ErrorCode {
public final static int EVIL_HINTS = 2110;
public final static int EVIL_NAME = 2111;
public final static int EVIL_CONCAT = 2112;
public final static int ALWAY_FALSE = 2113;
public final static int NOT_PARAMETERIZED = 2200;
public final static int MULTI_TENANT = 2201;
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest43.java
+26 -5
View File
@@ -36,19 +36,40 @@ public class MySqlWallTest43 extends TestCase {
Assert.assertFalse(provider.checkValid(//
"SELECT COUNT(1) AS count FROM `team` " + //
"WHERE `team_type` = 'normal' AND 1 = 1 AND `city_id` IN (0,10)"));
"WHERE `team_type` = 'normal' AND 1 = 1 AND `city_id` IN (0,10)"));
Assert.assertEquals(1, provider.getTableStats().size());
}
public void test_true() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setConditionAndAlwayTrueAllow(true);
Assert.assertTrue(provider.checkValid(//
"SELECT COUNT(1) AS count FROM `team` " + //
"SELECT COUNT(1) AS count FROM `team` " + //
"WHERE `team_type` = 'normal' AND 1 = 1 AND `city_id` IN (0,10)"));
Assert.assertEquals(1, provider.getTableStats().size());
}
public void test_false2() throws Exception {
WallProvider provider = new MySqlWallProvider();
Assert.assertFalse(provider.checkValid(//
"SELECT COUNT(1) AS count FROM `team` " + //
"WHERE `team_type` = 'normal' AND 1 = 2 AND `city_id` IN (0,10)"));
Assert.assertEquals(1, provider.getTableStats().size());
}
public void test_true2() throws Exception {
WallProvider provider = new MySqlWallProvider();
provider.getConfig().setConditionAndAlwayFalseAllow(true);
Assert.assertTrue(provider.checkValid(//
"SELECT COUNT(1) AS count FROM `team` " + //
"WHERE `team_type` = 'normal' AND 1 = 2 AND `city_id` IN (0,10)"));
Assert.assertEquals(1, provider.getTableStats().size());
}
}