Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #708 from yakolee/master

Browse Source 
improve sqlwall
This commit is contained in:
Yako
2014-11-13 16:27:38 +08:00
parent c059727da3 5edabcbb81
commit e4ca3db2fa
18 changed files with 342 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/dialect/mysql/parser/MySqlLexer.java
+4 -31
View File
@@ -452,8 +452,8 @@ public class MySqlLexer extends Lexer {
}
endOfComment = isEOF();
if (!isHint && !isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
if (!isHint && !isAllowComment() && !isSafeComment(stringVal)) {
throw new NotAllowCommentException();
}
@@ -503,38 +503,11 @@ public class MySqlLexer extends Lexer {
return;
}
}
private boolean isSafeComment(String comment) {
if (comment == null) {
return true;
}
comment = comment.toLowerCase();
if (comment.indexOf("select") != -1 //
|| comment.indexOf("delete") != -1 //
|| comment.indexOf("insert") != -1 //
|| comment.indexOf("update") != -1 //
|| comment.indexOf("into") != -1 //
|| comment.indexOf("where") != -1 //
|| comment.indexOf("or") != -1 //
|| comment.indexOf("and") != -1 //
|| comment.indexOf("union") != -1 //
|| comment.indexOf('\'') != -1 //
|| comment.indexOf('=') != -1 //
|| comment.indexOf('>') != -1 //
|| comment.indexOf('<') != -1 //
|| comment.indexOf('&') != -1 //
|| comment.indexOf('|') != -1 //
|| comment.indexOf('^') != -1 //
) {
return false;
}
return true;
}
private boolean isIdentifierChar(char c) {
return c != '#' && CharTypes.isIdentifierChar(c);
}
public void scanNumber() {
mark = pos;
src/main/java/com/alibaba/druid/sql/dialect/sqlserver/parser/SQLServerLexer.java
+5 -5
View File
@@ -108,17 +108,13 @@ public class SQLServerLexer extends Lexer {
hasComment = true;
}
if (token != Token.HINT && !isAllowComment()) {
if (token != Token.HINT && !isAllowComment() && !isSafeComment(stringVal)) {
throw new NotAllowCommentException();
}
return;
}
if (!isAllowComment()) {
throw new NotAllowCommentException();
}
if (ch == '/' || ch == '-') {
scanChar();
bufPos++;
@@ -150,6 +146,10 @@ public class SQLServerLexer extends Lexer {
token = Token.LINE_COMMENT;
hasComment = true;
endOfComment = isEOF();
if (!isAllowComment() && (isEOF() || !isSafeComment(stringVal))) {
throw new NotAllowCommentException();
}
return;
}
}
src/main/java/com/alibaba/druid/sql/parser/Lexer.java
+27
View File
@@ -1064,5 +1064,32 @@ public class Lexer {
public boolean isEndOfComment() {
return endOfComment;
}
protected boolean isSafeComment(String comment) {
if (comment == null) {
return true;
}
comment = comment.toLowerCase();
if (comment.indexOf("select") != -1 //
|| comment.indexOf("delete") != -1 //
|| comment.indexOf("insert") != -1 //
|| comment.indexOf("update") != -1 //
|| comment.indexOf("into") != -1 //
|| comment.indexOf("where") != -1 //
|| comment.indexOf("or") != -1 //
|| comment.indexOf("and") != -1 //
|| comment.indexOf("union") != -1 //
|| comment.indexOf('\'') != -1 //
|| comment.indexOf('=') != -1 //
|| comment.indexOf('>') != -1 //
|| comment.indexOf('<') != -1 //
|| comment.indexOf('&') != -1 //
|| comment.indexOf('|') != -1 //
|| comment.indexOf('^') != -1 //
) {
return false;
}
return true;
}
}
src/main/java/com/alibaba/druid/wall/WallProvider.java
+1 -3
View File
@@ -645,9 +645,7 @@ public abstract class WallProvider {
}
WallVisitor visitor = createWallVisitor();
if (!endOfComment) {
visitor.getConfig().setSelectUnionCheck(false);
}
visitor.setSqlEndOfComment(endOfComment);
if (statementList.size() > 0) {
boolean lastIsHint = false;
src/main/java/com/alibaba/druid/wall/WallVisitor.java
+4
View File
@@ -39,4 +39,8 @@ public interface WallVisitor extends SQLASTVisitor {
void setSqlModified(boolean sqlModified);
String getDbType();
boolean isSqlEndOfComment();
void setSqlEndOfComment(boolean sqlEndOfComment);
}
src/main/java/com/alibaba/druid/wall/spi/DB2WallVisitor.java
+13 -2
View File
@@ -55,8 +55,9 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public DB2WallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -274,4 +275,14 @@ public class DB2WallVisitor extends DB2ASTVisitorAdapter implements WallVisitor
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+13 -2
View File
@@ -73,8 +73,9 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public MySqlWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -466,5 +467,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
+13 -2
View File
@@ -63,8 +63,9 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public OracleWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -347,4 +348,14 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/PGWallVisitor.java
+13 -2
View File
@@ -55,8 +55,9 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public PGWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -276,4 +277,14 @@ public class PGWallVisitor extends PGASTVisitorAdapter implements WallVisitor {
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+13 -2
View File
@@ -61,8 +61,9 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
private final WallConfig config;
private final WallProvider provider;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private final List<Violation> violations = new ArrayList<Violation>();
private boolean sqlModified = false;
private boolean sqlEndOfComment = false;
public SQLServerWallVisitor(WallProvider provider){
this.config = provider.getConfig();
@@ -333,4 +334,14 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
public boolean visit(SQLCreateTriggerStatement x) {
return false;
}
@Override
public boolean isSqlEndOfComment() {
return this.sqlEndOfComment;
}
@Override
public void setSqlEndOfComment(boolean sqlEndOfComment) {
this.sqlEndOfComment = sqlEndOfComment;
}
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+9 -6
View File
@@ -295,7 +295,8 @@ public class WallVisitorUtils {
Object whereValue = getConditionValue(visitor, where, visitor.getConfig().isSelectWhereAlwayTrueCheck());
if (Boolean.TRUE == whereValue) {
if (!isSimpleConstExpr(where)) {// 简单表达式
if (visitor.getConfig().isSelectWhereAlwayTrueCheck() && visitor.isSqlEndOfComment()
&& !isSimpleConstExpr(where)) {// 简单表达式
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "select alway true condition not allow", x);
}
}
@@ -310,7 +311,8 @@ public class WallVisitorUtils {
}
if (Boolean.TRUE == getConditionValue(visitor, x, visitor.getConfig().isSelectHavingAlwayTrueCheck())) {
if (!isSimpleConstExpr(x)) {
if (visitor.getConfig().isSelectHavingAlwayTrueCheck() && visitor.isSqlEndOfComment()
&& !isSimpleConstExpr(x)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "having alway true condition not allow", x);
}
}
@@ -349,7 +351,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isDeleteWhereAlwayTrueCheck())) {
if (!isSimpleConstExpr(where)) {
if (config.isDeleteWhereAlwayTrueCheck() && visitor.isSqlEndOfComment() && !isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "delete alway true condition not allow", x);
}
}
@@ -942,7 +944,7 @@ public class WallVisitorUtils {
checkCondition(visitor, where);
if (Boolean.TRUE == getConditionValue(visitor, where, config.isUpdateWhereAlayTrueCheck())) {
if (!isSimpleConstExpr(where)) {
if (config.isUpdateWhereAlayTrueCheck() && visitor.isSqlEndOfComment()&& !isSimpleConstExpr(where)) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "update alway true condition not allow", x);
}
}
@@ -1388,7 +1390,7 @@ public class WallVisitorUtils {
}
}
if (current.hasPartAlwayTrue() && alwayTrueCheck && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
if (current.hasPartAlwayTrue() && !visitor.getConfig().isConditionAndAlwayTrueAllow()) {
addViolation(visitor, ErrorCode.ALWAYS_TRUE, "part alway true condition not allow", x);
}
@@ -2198,7 +2200,8 @@ public class WallVisitorUtils {
context.incrementUnionWarnings();
}
if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT) && visitor.getConfig().isSelectUnionCheck())
if (((x.getOperator() == SQLUnionOperator.UNION || x.getOperator() == SQLUnionOperator.UNION_ALL || x.getOperator() == SQLUnionOperator.DISTINCT)
&& visitor.getConfig().isSelectUnionCheck() && visitor.isSqlEndOfComment())
|| (x.getOperator() == SQLUnionOperator.MINUS && visitor.getConfig().isSelectMinusCheck())
|| (x.getOperator() == SQLUnionOperator.INTERSECT && visitor.getConfig().isSelectIntersectCheck())
|| (x.getOperator() == SQLUnionOperator.EXCEPT && visitor.getConfig().isSelectExceptCheck())) {