From df7ef2fd663c7c717dc919cf298cf69af0cb56eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=AB=98=E9=93=81?= <shaojin.wensj@alibaba-inc.com>
Date: Tue, 27 Aug 2019 18:22:13 +0800
Subject: [PATCH] bug fix for sql wall

---
 .../druid/wall/spi/WallVisitorUtils.java        | 14 ++++++++++++++
 .../filter/wall/mysql/MySqlWallTest_union.java  | 17 +++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index 25219ff5b0..80a059f655 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -288,6 +288,20 @@ public class WallVisitorUtils {
             return;
         }
 
+        List<SQLCommentHint> hints = x.getHintsDirect();
+        if (hints != null
+                && x.getParent() instanceof SQLUnionQuery
+                && x == ((SQLUnionQuery) x.getParent()).getRight()
+        ) {
+            for (SQLCommentHint hint : hints) {
+                String text = hint.getText();
+                if (text.startsWith("!")) {
+                    addViolation(visitor, ErrorCode.UNION, "union select hint not allow", x);
+                    return;
+                }
+            }
+        }
+
         SQLExpr where = x.getWhere();
         if (where != null) {
             checkCondition(visitor, x.getWhere());
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/mysql/MySqlWallTest_union.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/mysql/MySqlWallTest_union.java
index 78d173a53d..2989e9ab53 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/mysql/MySqlWallTest_union.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/mysql/MySqlWallTest_union.java
@@ -44,4 +44,21 @@ public class MySqlWallTest_union extends TestCase {
 
         Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select 'u1' as u1, 'u2' as u2",  config)); // union select item has alias
     }
+
+    public void testUnion2() throws Exception
+    {
+        assertFalse(
+                WallUtils.isValidateMySql("SELECT name, surname FROM users WHERE name='' UNION SELECT @@version, 'string1'")
+        );
+
+        assertFalse(
+                WallUtils.isValidateMySql("SELECT name, surname FROM users WHERE name='' UNION SELECT /*! @@version,*/ 'string1'")
+        );
+
+    assertFalse(
+                WallUtils.isValidateMySql("SELECT name, surname FROM users WHERE name=' ' UNION SELECT /*! (select table_name FROM information_schema.tables limit 1,1),*/ 'string1'")
+        );
+
+
+    }
 }