Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #708 from yakolee/master

Browse Source 
improve sqlwall
This commit is contained in:
Yako
2014-11-13 16:27:38 +08:00
parent c059727da3 5edabcbb81
commit e4ca3db2fa
18 changed files with 342 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+4 -31
View File
@@ -452,8 +452,8 @@ public class MySqlLexer extends Lexer {
}
endOfComment = isEOF();
if (!isHint && !isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
if (!isHint && !isAllowComment() && !isSafeComment(stringVal)) {
throw new NotAllowCommentException();
}
@@ -503,38 +503,11 @@ public class MySqlLexer extends Lexer {
return;
}
}
private boolean isSafeComment(String comment) {
if (comment == null) {
return true;
}
comment = comment.toLowerCase();
if (comment.indexOf("select") != -1 //
|| comment.indexOf("delete") != -1 //
|| comment.indexOf("insert") != -1 //
|| comment.indexOf("update") != -1 //
|| comment.indexOf("into") != -1 //
|| comment.indexOf("where") != -1 //
|| comment.indexOf("or") != -1 //
|| comment.indexOf("and") != -1 //
|| comment.indexOf("union") != -1 //
|| comment.indexOf('\'') != -1 //
|| comment.indexOf('=') != -1 //
|| comment.indexOf('>') != -1 //
|| comment.indexOf('<') != -1 //
|| comment.indexOf('&') != -1 //
|| comment.indexOf('|') != -1 //
|| comment.indexOf('^') != -1 //
) {
return false;
}
return true;
}
private boolean isIdentifierChar(char c) {
return c != '#' && CharTypes.isIdentifierChar(c);
}
public void scanNumber() {
mark = pos;
src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java
+5 -5
View File
@@ -108,17 +108,13 @@ public class SQLServerLexer extends Lexer {
hasComment = true;
}
if (token != Token.HINT && !isAllowComment()) {
if (token != Token.HINT && !isAllowComment() && !isSafeComment(stringVal)) {
throw new NotAllowCommentException();
}
return;
}
if (!isAllowComment()) {
throw new NotAllowCommentException();
}
if (ch == '/' || ch == '-') {
scanChar();
bufPos++;
@@ -150,6 +146,10 @@ public class SQLServerLexer extends Lexer {
token = Token.LINE_COMMENT;
hasComment = true;
endOfComment = isEOF();
if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
throw new NotAllowCommentException();
}
return;
}
}
src/main/java/com/alibaba/druid/sql/parser/Lexer.java
+27
View File
@@ -1064,5 +1064,32 @@ public class Lexer {
public boolean isEndOfComment() {
return endOfComment;
}
protected boolean isSafeComment(String comment) {
if (comment == null) {
return true;
}
comment = comment.toLowerCase();
if (comment.indexOf("select") != -1 //
|| comment.indexOf("delete") != -1 //
|| comment.indexOf("insert") != -1 //
|| comment.indexOf("update") != -1 //
|| comment.indexOf("into") != -1 //
|| comment.indexOf("where") != -1 //
|| comment.indexOf("or") != -1 //
|| comment.indexOf("and") != -1 //
|| comment.indexOf("union") != -1 //
|| comment.indexOf('\'') != -1 //
|| comment.indexOf('=') != -1 //
|| comment.indexOf('>') != -1 //
|| comment.indexOf('<') != -1 //
|| comment.indexOf('&') != -1 //
|| comment.indexOf('|') != -1 //
|| comment.indexOf('^') != -1 //
) {
return false;
}
return true;
}
}
src/main/java/com/alibaba/druid/wall/WallProvider.java
+1 -3
View File
@@ -645,9 +645,7 @@ public abstract class WallProvider {
}
WallVisitor visitor = createWallVisitor();
if (!endOfComment) {
visitor.getConfig().setSelectUnionCheck(false);
}
visitor.setSqlEndOfComment(endOfComment);
if (statementList.size() > 0) {
boolean lastIsHint = false;
src/main/java/com/alibaba/druid/wall/WallVisitor.java
+4
View File
@@ -39,4 +39,8 @@ public interface WallVisitor extends SQLASTVisitor {
void setSqlModified(boolean sqlModified);
String getDbType();
boolean isSqlEndOfComment();
void setSqlEndOfComment(boolean sqlEndOfComment);
}
src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java
+13 -2
View File
@@ -55,8 +55,9 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public DB2WallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -274,4 +275,14 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+13 -2
View File
@@ -73,8 +73,9 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public MySqlWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -466,5 +467,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
+13 -2
View File
@@ -63,8 +63,9 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public OracleWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -347,4 +348,14 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java
+13 -2
View File
@@ -55,8 +55,9 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public PGWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -276,4 +277,14 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+13 -2
View File
@@ -61,8 +61,9 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public SQLServerWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -333,4 +334,14 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+9 -6
View File
@@ -295,7 +295,8 @@ public class WallVisitorUtils {
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
if (Boolean.TRUE == whereValue) {
if (!isSimpleConstExpr(where)) {// 简单表达式
if (visitor.getConfig().isSelectWhereAlwayTrueCheck() && visitor.isSqlEndOfComment()
&& !isSimpleConstExpr(where)) {// 简单表达式
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "select alway true condition not allow", x);
}
}
@@ -310,7 +311,8 @@ public class WallVisitorUtils {
}
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
if (!isSimpleConstExpr(x)) {
if (visitor.getConfig().isSelectHavingAlwayTrueCheck() && visitor.isSqlEndOfComment()
&& !isSimpleConstExpr(x)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x);
}
}
@@ -349,7 +351,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) {
if (!isSimpleConstExpr(where)) {
if (config.isDeleteWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() && !isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x);
}
}
@@ -942,7 +944,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) {
if (!isSimpleConstExpr(where)) {
if (config.isUpdateWhereAlayTrueCheck() && visitor.isSqlEndOfComment()&& !isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x);
}
}
@@ -1388,7 +1390,7 @@ public class WallVisitorUtils {
}
}
if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
if (current.hasPartAlwayTrue() && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x);
}
@@ -2198,7 +2200,8 @@ public class WallVisitorUtils {
context.incrementUnionWarnings();
}
if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) && visitor.getConfig().isSelectUnionCheck())
if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT)
&& visitor.getConfig().isSelectUnionCheck() && visitor.isSqlEndOfComment())
|| (x.getOperator() == SQLUnionOperator.MINUS && visitor.getConfig().isSelectMinusCheck())
|| (x.getOperator() == SQLUnionOperator.INTERSECT && visitor.getConfig().isSelectIntersectCheck())
|| (x.getOperator() == SQLUnionOperator.EXCEPT && visitor.getConfig().isSelectExceptCheck())) {
src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java
+9 -9
View File
@@ -74,7 +74,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false3() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 ";
String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 --ORDER BY SiteID LIMIT 1 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -82,7 +82,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false4() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 ";
String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 --order by sort desc limit 17 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -90,7 +90,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false5() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')";
String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='') --";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -98,7 +98,7 @@ public class MySqlWallTest91 extends TestCase {
public void test_false6() throws Exception {
WallProvider provider = initWallProvider();
{
String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 ";
String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') --limit 0,20 ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -257,12 +257,12 @@ public class MySqlWallTest91 extends TestCase {
Assert.assertTrue(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'";
Assert.assertFalse(provider.checkValid(sql));
}
{
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true";
String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1' --";
Assert.assertFalse(provider.checkValid(sql));
}
// {
// String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true --";
// Assert.assertFalse(provider.checkValid(sql));
// }
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java
+1 -1
View File
@@ -56,7 +56,7 @@ public class SQLServerWallTest extends TestCase {
public void test_stuff() throws Exception {
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from table where version = @@version"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT 1 — comment"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT /*comment*/1"));
Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from t where a=1 /* and b=1*/"));
Assert.assertFalse(WallUtils.isValidateSqlServer("WAITFOR DELAY ’0:0:5′ "));
Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;"));
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java
+52
View File
@@ -0,0 +1,52 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallDeleteWhereTest2 extends TestCase {
private String sql = "DELETE FROM T WHERE id = 0 or 1 = 1 --";
private String sql1 = "DELETE FROM T WHERE id = 0 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setDeleteWhereAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java
+56
View File
@@ -0,0 +1,56 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallHavingTest6 extends TestCase {
private String sql = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 --";
private String sql1 = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setSelectHavingAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setSelectHavingAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java
+1 -1
View File
@@ -22,7 +22,7 @@ import org.junit.Assert;
import com.alibaba.druid.wall.WallUtils;
public class WallMultiLineCommentTest extends TestCase {
private String sql = "select f1 from t /* xx */";
private String sql = "select f1 from t where a=1 /* and b=1 */";
public void testOracle() throws Exception {
Assert.assertFalse(WallUtils.isValidateOracle(sql));
src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java
+56
View File
@@ -0,0 +1,56 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallSelectWhereTest6 extends TestCase {
private String sql = "SELECT * FROM T WHERE id = 0 or 1 = 1 --";
private String sql1 = "SELECT * FROM T WHERE id = 0 or 1 = 1 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setSelectWhereAlwayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setSelectWhereAlwayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}
src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java
+52
View File
@@ -0,0 +1,52 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallConfig;
import com.alibaba.druid.wall.WallUtils;
/**
* @author wenshao
*/
public class WallUpdateWhereTest1 extends TestCase {
private String sql = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 --";
private String sql1 = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 #and c=1";
public void test_check_true() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereAlayTrueCheck(true);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
Assert.assertFalse(WallUtils.isValidateMySql(sql1, config));
}
public void test_check_false() throws Exception {
WallConfig config = new WallConfig();
config.setUpdateWhereAlayTrueCheck(false);
config.setConditionAndAlwayTrueAllow(true);
config.setCommentAllow(true);
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
Assert.assertTrue(WallUtils.isValidateMySql(sql1, config));
}
}