diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java index 425ba50e1a..051a9bd3e7 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java @@ -452,8 +452,8 @@ public class MySqlLexer extends Lexer { } endOfComment = isEOF(); - - if (!isHint && !isAllowComment() && (isEOF() || !isSafeComment(stringVal))) { + + if (!isHint && !isAllowComment() && !isSafeComment(stringVal)) { throw new NotAllowCommentException(); } @@ -503,38 +503,11 @@ public class MySqlLexer extends Lexer { return; } } - - private boolean isSafeComment(String comment) { - if (comment == null) { - return true; - } - comment = comment.toLowerCase(); - if (comment.indexOf("select") != -1 // - || comment.indexOf("delete") != -1 // - || comment.indexOf("insert") != -1 // - || comment.indexOf("update") != -1 // - || comment.indexOf("into") != -1 // - || comment.indexOf("where") != -1 // - || comment.indexOf("or") != -1 // - || comment.indexOf("and") != -1 // - || comment.indexOf("union") != -1 // - || comment.indexOf('\'') != -1 // - || comment.indexOf('=') != -1 // - || comment.indexOf('>') != -1 // - || comment.indexOf('<') != -1 // - || comment.indexOf('&') != -1 // - || comment.indexOf('|') != -1 // - || comment.indexOf('^') != -1 // - ) { - return false; - } - return true; - } - + private boolean isIdentifierChar(char c) { return c != '#' && CharTypes.isIdentifierChar(c); } - + public void scanNumber() { mark = pos; diff --git a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java index d3fe54c31c..0f50a6fc91 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java @@ -108,17 +108,13 @@ public class SQLServerLexer extends Lexer { hasComment = true; } - if (token != Token.HINT && !isAllowComment()) { + if (token != Token.HINT && !isAllowComment() && !isSafeComment(stringVal)) { throw new NotAllowCommentException(); } return; } - if (!isAllowComment()) { - throw new NotAllowCommentException(); - } - if (ch == '/' || ch == '-') { scanChar(); bufPos++; @@ -150,6 +146,10 @@ public class SQLServerLexer extends Lexer { token = Token.LINE_COMMENT; hasComment = true; endOfComment = isEOF(); + + if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) { + throw new NotAllowCommentException(); + } return; } } diff --git a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java index 7b6e57a0f1..503b1e85f3 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/Lexer.java +++ b/src/main/java/com/alibaba/druid/sql/parser/Lexer.java @@ -1064,5 +1064,32 @@ public class Lexer { public boolean isEndOfComment() { return endOfComment; } + + protected boolean isSafeComment(String comment) { + if (comment == null) { + return true; + } + comment = comment.toLowerCase(); + if (comment.indexOf("select") != -1 // + || comment.indexOf("delete") != -1 // + || comment.indexOf("insert") != -1 // + || comment.indexOf("update") != -1 // + || comment.indexOf("into") != -1 // + || comment.indexOf("where") != -1 // + || comment.indexOf("or") != -1 // + || comment.indexOf("and") != -1 // + || comment.indexOf("union") != -1 // + || comment.indexOf('\'') != -1 // + || comment.indexOf('=') != -1 // + || comment.indexOf('>') != -1 // + || comment.indexOf('<') != -1 // + || comment.indexOf('&') != -1 // + || comment.indexOf('|') != -1 // + || comment.indexOf('^') != -1 // + ) { + return false; + } + return true; + } } diff --git a/src/main/java/com/alibaba/druid/wall/WallProvider.java b/src/main/java/com/alibaba/druid/wall/WallProvider.java index 3598817732..c818ec9120 100644 --- a/src/main/java/com/alibaba/druid/wall/WallProvider.java +++ b/src/main/java/com/alibaba/druid/wall/WallProvider.java @@ -645,9 +645,7 @@ public abstract class WallProvider { } WallVisitor visitor = createWallVisitor(); - if (!endOfComment) { - visitor.getConfig().setSelectUnionCheck(false); - } + visitor.setSqlEndOfComment(endOfComment); if (statementList.size() > 0) { boolean lastIsHint = false; diff --git a/src/main/java/com/alibaba/druid/wall/WallVisitor.java b/src/main/java/com/alibaba/druid/wall/WallVisitor.java index 5e2676ebd7..c926e2a01b 100644 --- a/src/main/java/com/alibaba/druid/wall/WallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/WallVisitor.java @@ -39,4 +39,8 @@ public interface WallVisitor extends SQLASTVisitor { void setSqlModified(boolean sqlModified); String getDbType(); + + boolean isSqlEndOfComment(); + + void setSqlEndOfComment(boolean sqlEndOfComment); } diff --git a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java index 7d93da8754..16f2e28fc2 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java @@ -55,8 +55,9 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public DB2WallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -274,4 +275,14 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 2e14f2927f..5a707f001e 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -73,8 +73,9 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public MySqlWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -466,5 +467,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java index 8484d29b45..830ca77ee5 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java @@ -63,8 +63,9 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public OracleWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -347,4 +348,14 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java index 92eb817aae..671293d325 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java @@ -55,8 +55,9 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public PGWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -276,4 +277,14 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor { public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index 953d4e22d5..186d4066b7 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -61,8 +61,9 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements private final WallConfig config; private final WallProvider provider; - private final List violations = new ArrayList(); - private boolean sqlModified = false; + private final List violations = new ArrayList(); + private boolean sqlModified = false; + private boolean sqlEndOfComment = false; public SQLServerWallVisitor(WallProvider provider){ this.config = provider.getConfig(); @@ -333,4 +334,14 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements public boolean visit(SQLCreateTriggerStatement x) { return false; } + + @Override + public boolean isSqlEndOfComment() { + return this.sqlEndOfComment; + } + + @Override + public void setSqlEndOfComment(boolean sqlEndOfComment) { + this.sqlEndOfComment = sqlEndOfComment; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 7e8685443c..2e3c5dedb7 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -295,7 +295,8 @@ public class WallVisitorUtils { Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck()); if (Boolean.TRUE == whereValue) { - if (!isSimpleConstExpr(where)) {// 简单表达式 + if (visitor.getConfig().isSelectWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() + && !isSimpleConstExpr(where)) {// 简单表达式 addViolation(visitor, ErrorCode.ALWAYS_TRUE, "select alway true condition not allow", x); } } @@ -310,7 +311,8 @@ public class WallVisitorUtils { } if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) { - if (!isSimpleConstExpr(x)) { + if (visitor.getConfig().isSelectHavingAlwayTrueCheck() && visitor.isSqlEndOfComment() + && !isSimpleConstExpr(x)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x); } } @@ -349,7 +351,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) { - if (!isSimpleConstExpr(where)) { + if (config.isDeleteWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() && !isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x); } } @@ -942,7 +944,7 @@ public class WallVisitorUtils { checkCondition(visitor, where); if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) { - if (!isSimpleConstExpr(where)) { + if (config.isUpdateWhereAlayTrueCheck() && visitor.isSqlEndOfComment()&& !isSimpleConstExpr(where)) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x); } } @@ -1388,7 +1390,7 @@ public class WallVisitorUtils { } } - if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { + if (current.hasPartAlwayTrue() && !visitor.getConfig().isConditionAndAlwayTrueAllow()) { addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x); } @@ -2198,7 +2200,8 @@ public class WallVisitorUtils { context.incrementUnionWarnings(); } - if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) && visitor.getConfig().isSelectUnionCheck()) + if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) + && visitor.getConfig().isSelectUnionCheck() && visitor.isSqlEndOfComment()) || (x.getOperator() == SQLUnionOperator.MINUS && visitor.getConfig().isSelectMinusCheck()) || (x.getOperator() == SQLUnionOperator.INTERSECT && visitor.getConfig().isSelectIntersectCheck()) || (x.getOperator() == SQLUnionOperator.EXCEPT && visitor.getConfig().isSelectExceptCheck())) { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java index ff00096522..60d4161022 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest91.java @@ -74,7 +74,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false3() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 ORDER BY SiteID LIMIT 1 "; + String sql = "SELECT * FROM mp_Sites WHERE SiteID = -1 OR -1 = -1 --ORDER BY SiteID LIMIT 1 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -82,7 +82,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false4() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 order by sort desc limit 17 "; + String sql = "select cid,title,id,img,fan from duoduo_mall where cid = cid and 1=1 --order by sort desc limit 17 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -90,7 +90,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false5() throws Exception { WallProvider provider = initWallProvider(); { - String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='')"; + String sql = "select count(1) as cot from w36ma_picking where (picking_no='' or ''='') and (DATE_FORMAT(create_time,'%Y-%m-%d') = '' or ''='') --"; Assert.assertFalse(provider.checkValid(sql)); } } @@ -98,7 +98,7 @@ public class MySqlWallTest91 extends TestCase { public void test_false6() throws Exception { WallProvider provider = initWallProvider(); { - String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') limit 0,20 "; + String sql = " select pg.*,an1.w36ma_name as create_name, an2.w36ma_name as print_name, an2.w36ma_name as receive_name, an2.w36ma_name as products_name, an2.w36ma_name as warehouse_name from w36ma_picking as pg left join iweb_admin as an1 on pg.create_name_id=an1.id left join iweb_admin as an2 on pg.print_name_id=an2.id left join iweb_admin as an3 on pg.receive_name_id=an3.id left join iweb_admin as an4 on pg.products_name_id=an4.id left join iweb_admin as an5 on pg.warehouse_name_id=an5.id where (pg.picking_no='' or ''='') and (DATE_FORMAT(pg.create_time,'%Y-%m-%d') = '' or ''='') --limit 0,20 "; Assert.assertFalse(provider.checkValid(sql)); } } @@ -257,12 +257,12 @@ public class MySqlWallTest91 extends TestCase { Assert.assertTrue(provider.checkValid(sql)); } { - String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1'"; - Assert.assertFalse(provider.checkValid(sql)); - } - { - String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true"; + String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or 1='1' --"; Assert.assertFalse(provider.checkValid(sql)); } +// { +// String sql = "SELECT * FROM `oammxncom2014`.`ecs_free_bank` where id=1 or true --"; +// Assert.assertFalse(provider.checkValid(sql)); +// } } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java index 3817916c03..72e9f34d7f 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallTest.java @@ -56,7 +56,7 @@ public class SQLServerWallTest extends TestCase { public void test_stuff() throws Exception { Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from table where version = @@version")); Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT 1 — comment")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT /*comment*/1")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * from t where a=1 /* and b=1*/")); Assert.assertFalse(WallUtils.isValidateSqlServer("WAITFOR DELAY ’0:0:5′ ")); Assert.assertFalse(WallUtils.isValidateSqlServer("BULK INSERT mydata FROM ‘c:boot.ini’;")); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java new file mode 100644 index 0000000000..08a4ea789a --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest2.java @@ -0,0 +1,52 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallDeleteWhereTest2 extends TestCase { + + private String sql = "DELETE FROM T WHERE id = 0 or 1 = 1 --"; + private String sql1 = "DELETE FROM T WHERE id = 0 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setDeleteWhereAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setDeleteWhereAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java new file mode 100644 index 0000000000..52ee172eb1 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallHavingTest6.java @@ -0,0 +1,56 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallHavingTest6 extends TestCase { + + private String sql = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 --"; + + private String sql1 = "SELECT region, SUM(population), SUM(area) FROM bbc GROUP BY region HAVING SUM(area)>1000000 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectHavingAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectHavingAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } + + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java index d0d235b252..4434e43293 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java @@ -22,7 +22,7 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; public class WallMultiLineCommentTest extends TestCase { - private String sql = "select f1 from t /* xx */"; + private String sql = "select f1 from t where a=1 /* and b=1 */"; public void testOracle() throws Exception { Assert.assertFalse(WallUtils.isValidateOracle(sql)); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java new file mode 100644 index 0000000000..68c4aac950 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest6.java @@ -0,0 +1,56 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallSelectWhereTest6 extends TestCase { + + private String sql = "SELECT * FROM T WHERE id = 0 or 1 = 1 --"; + + private String sql1 = "SELECT * FROM T WHERE id = 0 or 1 = 1 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectWhereAlwayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setSelectWhereAlwayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } + + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java new file mode 100644 index 0000000000..10225c9c51 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest1.java @@ -0,0 +1,52 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallUtils; + +/** + * @author wenshao + */ +public class WallUpdateWhereTest1 extends TestCase { + + private String sql = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 --"; + private String sql1 = "update wx_shop set shop_view = shop_view + 1 where id = 118 OR 69=69 LIMIT 100 #and c=1"; + + public void test_check_true() throws Exception { + WallConfig config = new WallConfig(); + config.setUpdateWhereAlayTrueCheck(true); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertFalse(WallUtils.isValidateMySql(sql, config)); + Assert.assertFalse(WallUtils.isValidateMySql(sql1, config)); + } + + public void test_check_false() throws Exception { + WallConfig config = new WallConfig(); + config.setUpdateWhereAlayTrueCheck(false); + config.setConditionAndAlwayTrueAllow(true); + config.setCommentAllow(true); + + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + Assert.assertTrue(WallUtils.isValidateMySql(sql1, config)); + } +}