From e1f426e8cc5dc6f33c05ae6f8de545200f082877 Mon Sep 17 00:00:00 2001 From: wenshao Date: Mon, 18 Mar 2013 10:13:37 +0800 Subject: [PATCH] improve WallProvider --- pom.xml | 2 +- src/main/java/com/alibaba/druid/VERSION.java | 2 +- .../sql/visitor/SQLEvalVisitorUtils.java | 19 ++++++- .../druid/wall/spi/WallVisitorUtils.java | 50 +++++++++++++++++-- 4 files changed, 64 insertions(+), 9 deletions(-) diff --git a/pom.xml b/pom.xml index c18ad79e56..15466ccc32 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ com.alibaba druid - 0.2.12 + 0.2.13 jar druid diff --git a/src/main/java/com/alibaba/druid/VERSION.java b/src/main/java/com/alibaba/druid/VERSION.java index 4f63632830..06e52d2cd8 100644 --- a/src/main/java/com/alibaba/druid/VERSION.java +++ b/src/main/java/com/alibaba/druid/VERSION.java @@ -19,7 +19,7 @@ public final class VERSION { public final static int MajorVersion = 0; public final static int MinorVersion = 2; - public final static int RevisionVersion = 11; + public final static int RevisionVersion = 13; public static String getVersionNumber() { return VERSION.MajorVersion + "." + VERSION.MinorVersion + "." + VERSION.RevisionVersion; diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java index af79de83f7..7fe27f2d40 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java @@ -34,6 +34,7 @@ import com.alibaba.druid.sql.ast.SQLExpr; import com.alibaba.druid.sql.ast.SQLObject; import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr; import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; +import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator; import com.alibaba.druid.sql.ast.expr.SQLCaseExpr; import com.alibaba.druid.sql.ast.expr.SQLCharExpr; import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr; @@ -50,6 +51,8 @@ import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlEvalVisitorImpl; import com.alibaba.druid.sql.dialect.oracle.visitor.OracleEvalVisitor; import com.alibaba.druid.sql.dialect.postgresql.visitor.PGEvalVisitor; import com.alibaba.druid.util.JdbcUtils; +import com.alibaba.druid.wall.spi.WallVisitorUtils; +import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext; public class SQLEvalVisitorUtils { @@ -782,12 +785,24 @@ public class SQLEvalVisitorUtils { SQLExpr left = x.getLeft(); SQLExpr right = x.getRight(); + // final WallConditionContext old = wallConditionContextLocal.get(); + left.accept(visitor); + right.accept(visitor); + + if (x.getOperator() == SQLBinaryOperator.BooleanOr) { + final WallConditionContext wallContext = WallVisitorUtils.getWallConditionContext(); + if (wallContext != null) { + if (left.getAttribute(EVAL_VALUE) == Boolean.TRUE || right.getAttribute(EVAL_VALUE) == Boolean.TRUE) { + wallContext.setPartAllowTrue(true); + } + } + } + if (!left.getAttributes().containsKey(EVAL_VALUE)) { return false; } - right.accept(visitor); if (!right.getAttributes().containsKey(EVAL_VALUE)) { return false; } @@ -850,7 +865,7 @@ public class SQLEvalVisitorUtils { boolean matchResult = !Pattern.matches(pattern, input); x.putAttribute(EVAL_VALUE, matchResult); } - break; + break; case Like: { String pattern = castToString(right.getAttributes().get(EVAL_VALUE)); String input = castToString(left.getAttributes().get(EVAL_VALUE)); diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index bb29297f65..fc9258250d 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -88,7 +88,7 @@ public class WallVisitorUtils { && x.getParent() instanceof SQLSelectQueryBlock) { SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent(); SQLTableSource from = queryBlock.getFrom(); - + if (from instanceof SQLExprTableSource) { addViolation(visitor, x); } @@ -131,7 +131,7 @@ public class WallVisitorUtils { x.getWhere().setParent(x); checkCondition(visitor, x.getWhere()); - if (Boolean.TRUE == getValue(where)) { + if (Boolean.TRUE == getConditionValue(visitor, where)) { boolean isSimpleConstExpr = false; if (where instanceof SQLBinaryOpExpr) { SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) where; @@ -162,7 +162,7 @@ public class WallVisitorUtils { return; } - if (Boolean.TRUE == getValue(x)) { + if (Boolean.TRUE == getConditionValue(visitor, x)) { addViolation(visitor, x); } } @@ -179,7 +179,7 @@ public class WallVisitorUtils { return; } - if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { + if (x.getWhere() == null || Boolean.TRUE == getConditionValue(visitor, x.getWhere())) { addViolation(visitor, x); return; } @@ -374,7 +374,7 @@ public class WallVisitorUtils { return; } - if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { + if (x.getWhere() == null || Boolean.TRUE == getConditionValue(visitor, x.getWhere())) { addViolation(visitor, x); return; } @@ -434,6 +434,10 @@ public class WallVisitorUtils { for (int i = groupList.size() - 1; i >= 0; --i) { Object result = getValue(groupList.get(i)); if (Boolean.TRUE == result) { + final WallConditionContext wallContext = WallVisitorUtils.getWallConditionContext(); + if (wallContext != null) { + wallContext.setPartAllowTrue(true); + } return true; } @@ -588,6 +592,42 @@ public class WallVisitorUtils { return a.longValue() + b.longValue(); } + public static class WallConditionContext { + + private boolean partAllowTrue; + + public boolean isPartAllowTrue() { + return partAllowTrue; + } + + public void setPartAllowTrue(boolean partAllowTrue) { + this.partAllowTrue = partAllowTrue; + } + } + + private static ThreadLocal wallConditionContextLocal = new ThreadLocal(); + + public static WallConditionContext getWallConditionContext() { + return wallConditionContextLocal.get(); + } + + public static Object getConditionValue(WallVisitor visitor, SQLExpr x) { + final WallConditionContext old = wallConditionContextLocal.get(); + try { + wallConditionContextLocal.set(new WallConditionContext()); + final Object value = getValue(x); + + final WallConditionContext current = wallConditionContextLocal.get(); + if (current.isPartAllowTrue() && visitor.getConfig().isUpdateWhereAlayTrueCheck()) { + addViolation(visitor, x); + } + + return value; + } finally { + wallConditionContextLocal.set(old); + } + } + public static Object getValue(SQLExpr x) { if (x instanceof SQLBinaryOpExpr) { return getValue((SQLBinaryOpExpr) x);