diff --git a/pom.xml b/pom.xml
index c18ad79e56..15466ccc32 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
com.alibaba
druid
- 0.2.12
+ 0.2.13
jar
druid
diff --git a/src/main/java/com/alibaba/druid/VERSION.java b/src/main/java/com/alibaba/druid/VERSION.java
index 4f63632830..06e52d2cd8 100644
--- a/src/main/java/com/alibaba/druid/VERSION.java
+++ b/src/main/java/com/alibaba/druid/VERSION.java
@@ -19,7 +19,7 @@ public final class VERSION {
public final static int MajorVersion = 0;
public final static int MinorVersion = 2;
- public final static int RevisionVersion = 11;
+ public final static int RevisionVersion = 13;
public static String getVersionNumber() {
return VERSION.MajorVersion + "." + VERSION.MinorVersion + "." + VERSION.RevisionVersion;
diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
index af79de83f7..7fe27f2d40 100644
--- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
@@ -34,6 +34,7 @@ import com.alibaba.druid.sql.ast.SQLExpr;
import com.alibaba.druid.sql.ast.SQLObject;
import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
+import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator;
import com.alibaba.druid.sql.ast.expr.SQLCaseExpr;
import com.alibaba.druid.sql.ast.expr.SQLCharExpr;
import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
@@ -50,6 +51,8 @@ import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlEvalVisitorImpl;
import com.alibaba.druid.sql.dialect.oracle.visitor.OracleEvalVisitor;
import com.alibaba.druid.sql.dialect.postgresql.visitor.PGEvalVisitor;
import com.alibaba.druid.util.JdbcUtils;
+import com.alibaba.druid.wall.spi.WallVisitorUtils;
+import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext;
public class SQLEvalVisitorUtils {
@@ -782,12 +785,24 @@ public class SQLEvalVisitorUtils {
SQLExpr left = x.getLeft();
SQLExpr right = x.getRight();
+ // final WallConditionContext old = wallConditionContextLocal.get();
+
left.accept(visitor);
+ right.accept(visitor);
+
+ if (x.getOperator() == SQLBinaryOperator.BooleanOr) {
+ final WallConditionContext wallContext = WallVisitorUtils.getWallConditionContext();
+ if (wallContext != null) {
+ if (left.getAttribute(EVAL_VALUE) == Boolean.TRUE || right.getAttribute(EVAL_VALUE) == Boolean.TRUE) {
+ wallContext.setPartAllowTrue(true);
+ }
+ }
+ }
+
if (!left.getAttributes().containsKey(EVAL_VALUE)) {
return false;
}
- right.accept(visitor);
if (!right.getAttributes().containsKey(EVAL_VALUE)) {
return false;
}
@@ -850,7 +865,7 @@ public class SQLEvalVisitorUtils {
boolean matchResult = !Pattern.matches(pattern, input);
x.putAttribute(EVAL_VALUE, matchResult);
}
- break;
+ break;
case Like: {
String pattern = castToString(right.getAttributes().get(EVAL_VALUE));
String input = castToString(left.getAttributes().get(EVAL_VALUE));
diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index bb29297f65..fc9258250d 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -88,7 +88,7 @@ public class WallVisitorUtils {
&& x.getParent() instanceof SQLSelectQueryBlock) {
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent();
SQLTableSource from = queryBlock.getFrom();
-
+
if (from instanceof SQLExprTableSource) {
addViolation(visitor, x);
}
@@ -131,7 +131,7 @@ public class WallVisitorUtils {
x.getWhere().setParent(x);
checkCondition(visitor, x.getWhere());
- if (Boolean.TRUE == getValue(where)) {
+ if (Boolean.TRUE == getConditionValue(visitor, where)) {
boolean isSimpleConstExpr = false;
if (where instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) where;
@@ -162,7 +162,7 @@ public class WallVisitorUtils {
return;
}
- if (Boolean.TRUE == getValue(x)) {
+ if (Boolean.TRUE == getConditionValue(visitor, x)) {
addViolation(visitor, x);
}
}
@@ -179,7 +179,7 @@ public class WallVisitorUtils {
return;
}
- if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) {
+ if (x.getWhere() == null || Boolean.TRUE == getConditionValue(visitor, x.getWhere())) {
addViolation(visitor, x);
return;
}
@@ -374,7 +374,7 @@ public class WallVisitorUtils {
return;
}
- if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) {
+ if (x.getWhere() == null || Boolean.TRUE == getConditionValue(visitor, x.getWhere())) {
addViolation(visitor, x);
return;
}
@@ -434,6 +434,10 @@ public class WallVisitorUtils {
for (int i = groupList.size() - 1; i >= 0; --i) {
Object result = getValue(groupList.get(i));
if (Boolean.TRUE == result) {
+ final WallConditionContext wallContext = WallVisitorUtils.getWallConditionContext();
+ if (wallContext != null) {
+ wallContext.setPartAllowTrue(true);
+ }
return true;
}
@@ -588,6 +592,42 @@ public class WallVisitorUtils {
return a.longValue() + b.longValue();
}
+ public static class WallConditionContext {
+
+ private boolean partAllowTrue;
+
+ public boolean isPartAllowTrue() {
+ return partAllowTrue;
+ }
+
+ public void setPartAllowTrue(boolean partAllowTrue) {
+ this.partAllowTrue = partAllowTrue;
+ }
+ }
+
+ private static ThreadLocal wallConditionContextLocal = new ThreadLocal();
+
+ public static WallConditionContext getWallConditionContext() {
+ return wallConditionContextLocal.get();
+ }
+
+ public static Object getConditionValue(WallVisitor visitor, SQLExpr x) {
+ final WallConditionContext old = wallConditionContextLocal.get();
+ try {
+ wallConditionContextLocal.set(new WallConditionContext());
+ final Object value = getValue(x);
+
+ final WallConditionContext current = wallConditionContextLocal.get();
+ if (current.isPartAllowTrue() && visitor.getConfig().isUpdateWhereAlayTrueCheck()) {
+ addViolation(visitor, x);
+ }
+
+ return value;
+ } finally {
+ wallConditionContextLocal.set(old);
+ }
+ }
+
public static Object getValue(SQLExpr x) {
if (x instanceof SQLBinaryOpExpr) {
return getValue((SQLBinaryOpExpr) x);