From e62605bfede3152e6327d9d4c03231ee0a0ca539 Mon Sep 17 00:00:00 2001
From: yakolee <yakolyh@gmail.com>
Date: Thu, 10 Apr 2014 11:20:02 +0800
Subject: [PATCH] improve sql wall

---
 src/main/java/com/alibaba/druid/wall/WallProvider.java |  2 +-
 .../com/alibaba/druid/wall/spi/WallVisitorUtils.java   | 10 ++++++++--
 .../alibaba/druid/bvt/filter/wall/MySqlWallTest.java   |  3 +++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/alibaba/druid/wall/WallProvider.java b/src/main/java/com/alibaba/druid/wall/WallProvider.java
index f8da88399f..b5dc28d278 100644
--- a/src/main/java/com/alibaba/druid/wall/WallProvider.java
+++ b/src/main/java/com/alibaba/druid/wall/WallProvider.java
@@ -632,7 +632,7 @@ public abstract class WallProvider {
                                                                                      + lastToken, sql));
             }
         } catch (NotAllowCommentException e) {
-            violations.add(new SyntaxErrorViolation(e, sql));
+            violations.add(new IllegalSQLObjectViolation(ErrorCode.COMMENT_STATEMENT_NOT_ALLOW, "comment not allow", sql));
             incrementCommentDeniedCount();
         } catch (ParserException e) {
             syntaxErrrorCount.incrementAndGet();
diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index 6760ddf5f8..5fd1d05463 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -347,6 +347,12 @@ public class WallVisitorUtils {
         }
 
         for (SQLExpr part : parts) {
+            if(isFirst(part)) {
+                Object evalValue = part.getAttribute(EVAL_VALUE);
+                if(evalValue != null && evalValue instanceof Boolean && (Boolean)evalValue) {
+                    return true;
+                }
+            }
             boolean isSimpleConstExpr = false;
             if (part == sqlExpr || part instanceof SQLLiteralExpr) {
                 isSimpleConstExpr = true;
@@ -2358,11 +2364,11 @@ public class WallVisitorUtils {
             errorCode = ErrorCode.SHOW_NOT_ALLOW;
         } else if (x instanceof MySqlCommitStatement) {
             allow = config.isCommitAllow();
-            denyMessage = "show not allow";
+            denyMessage = "commit not allow";
             errorCode = ErrorCode.COMMIT_NOT_ALLOW;
         } else if (x instanceof SQLRollbackStatement) {
             allow = config.isRollbackAllow();
-            denyMessage = "show not allow";
+            denyMessage = "rollback not allow";
             errorCode = ErrorCode.ROLLBACK_NOT_ALLOW;
         } else if (x instanceof SQLUseStatement) {
             allow = config.isUseAllow();
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
index e684e2fc13..cd62a7757a 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java
@@ -45,5 +45,8 @@ public class MySqlWallTest extends TestCase {
         Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'"));
 
         Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2"));
+        
+        Assert.assertTrue(WallUtils.isValidateMySql("select c1 from t where 1=1 or id =1"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 or 1=1"));
     }
 }