Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

refactor

Browse Source
This commit is contained in:
温少
2012-03-17 15:49:05 +08:00
parent 946e43db53 f25fc12df4
commit e6859dd726
5 changed files with 91 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/filter/wall/WallConfig.java
+19
View File
@@ -9,11 +9,14 @@ import com.alibaba.druid.filter.wall.spi.WallVisitorUtils;
public class WallConfig {
private boolean noneBaseStatementAllow = false;
private boolean selelctAllow = true;
private boolean selectIntoAllow = true;
private boolean selectIntoOutfileAllow = false;
private boolean selectWhereAlwayTrueCheck = true;
private boolean selectHavingAlwayTrueCheck = true;
private boolean selectUnionCheck = true;
private boolean deleteAllow = true;
private boolean deleteWhereAlwayTrueCheck = true;
@@ -75,6 +78,14 @@ public class WallConfig {
loadResource(getPermitObjects(), dir + "/permit-object.txt");
}
public boolean isNoneBaseStatementAllow() {
return noneBaseStatementAllow;
}
public void setNoneBaseStatementAllow(boolean noneBaseStatementAllow) {
this.noneBaseStatementAllow = noneBaseStatementAllow;
}
public boolean isSelelctAllow() {
return selelctAllow;
}
@@ -99,6 +110,14 @@ public class WallConfig {
this.selectIntoOutfileAllow = selectIntoOutfileAllow;
}
public boolean isSelectUnionCheck() {
return selectUnionCheck;
}
public void setSelectUnionCheck(boolean selectUnionCheck) {
this.selectUnionCheck = selectUnionCheck;
}
public boolean isSelectWhereAlwayTrueCheck() {
return selectWhereAlwayTrueCheck;
}
src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java
+5 -3
View File
@@ -176,9 +176,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
@Override
public boolean visit(SQLUnionQuery x) {
if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
}
WallVisitorUtils.checkUnion(this, x);
return true;
}
@@ -202,6 +200,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
if (!(x instanceof SQLStatement)) {
return;
}
if (config.isNoneBaseStatementAllow()) {
return;
}
if (x instanceof SQLInsertStatement) {
src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java
+6 -10
View File
@@ -16,7 +16,6 @@ import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
@@ -65,11 +64,6 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
return true;
}
public boolean visit(SQLDropTableStatement x) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toOracleString(x)));
return false;
}
@Override
public boolean visit(SQLMethodInvokeExpr x) {
WallVisitorUtils.checkFunction(this, x);
@@ -113,9 +107,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
@Override
public boolean visit(SQLUnionQuery x) {
if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
}
WallVisitorUtils.checkUnion(this, x);
return true;
}
@@ -143,6 +135,10 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
return;
}
if (config.isNoneBaseStatementAllow()) {
return;
}
if (x instanceof SQLInsertStatement) {
} else if (x instanceof SQLSelectStatement) {
@@ -154,7 +150,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
} else if (x instanceof OracleMergeStatement) {
} else {
violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x)));
violations.add(new IllegalSQLObjectViolation(toSQL(x)));
}
}
src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java
+29 -13
View File
@@ -14,6 +14,7 @@ import com.alibaba.druid.logging.Log;
import com.alibaba.druid.logging.LogFactory;
import com.alibaba.druid.sql.ast.SQLExpr;
import com.alibaba.druid.sql.ast.SQLName;
import com.alibaba.druid.sql.ast.SQLObject;
import com.alibaba.druid.sql.ast.expr.SQLAggregateExpr;
import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -36,6 +37,7 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectQuery;
import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
import com.alibaba.druid.sql.ast.statement.SQLSubqueryTableSource;
import com.alibaba.druid.sql.ast.statement.SQLTableSource;
import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlBooleanExpr;
import com.alibaba.druid.util.JdbcUtils;
@@ -49,17 +51,17 @@ public class WallVisitorUtils {
String owner = x.getOwner().toString();
owner = WallVisitorUtils.form(owner);
if (visitor.getConfig().isPermitObjects(owner)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
}
public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) {
if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
return;
}
if (!visitor.getConfig().isSelectWhereAlwayTrueCheck()) {
return;
}
@@ -77,7 +79,7 @@ public class WallVisitorUtils {
}
}
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
@@ -91,13 +93,13 @@ public class WallVisitorUtils {
}
if (Boolean.TRUE == getValue(x)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
public static void checkDelete(WallVisitor visitor, SQLDeleteStatement x) {
if (!visitor.getConfig().isDeleteAllow()) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
return;
}
@@ -106,13 +108,13 @@ public class WallVisitorUtils {
}
if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
public static void checkUpdate(WallVisitor visitor, SQLUpdateStatement x) {
if (!visitor.getConfig().isUpdateAllow()) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
return;
}
@@ -121,7 +123,7 @@ public class WallVisitorUtils {
}
if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
@@ -397,7 +399,7 @@ public class WallVisitorUtils {
String owner = x.getOwner().toString();
owner = WallVisitorUtils.form(owner);
if (visitor.getConfig().isPermitObjects(owner)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
@@ -408,7 +410,7 @@ public class WallVisitorUtils {
String methodName = x.getMethodName();
if (visitor.getConfig().isPermitFunction(methodName.toLowerCase())) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
@@ -426,7 +428,7 @@ public class WallVisitorUtils {
ownerName = form(ownerName);
if (visitor.getConfig().getPermitSchemas().contains(ownerName.toLowerCase())) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
@@ -440,11 +442,25 @@ public class WallVisitorUtils {
if (tableName != null) {
tableName = form(tableName);
if (visitor.containsPermitTable(tableName)) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
addViolation(visitor, x);
}
}
}
private static void addViolation(WallVisitor visitor, SQLObject x) {
visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
}
public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) {
if (!visitor.getConfig().isSelectUnionCheck()) {
return;
}
if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) {
addViolation(visitor, x);
}
}
public static boolean queryBlockFromIsNull(SQLSelectQuery query) {
if (query instanceof SQLSelectQueryBlock) {
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) query;
src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java
+32
View File
@@ -0,0 +1,32 @@
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.filter.wall.WallConfig;
import com.alibaba.druid.filter.wall.WallUtils;
/**
* 这个场景，检测
* @author wenshao
*
*/
public class WallDropTest1 extends TestCase {
private String sql = "DROP TABLE T1";
private WallConfig config = new WallConfig();
protected void setUp() throws Exception {
config.setNoneBaseStatementAllow(true);
}
public void testMySql() throws Exception {
Assert.assertTrue(WallUtils.isValidateMySql(sql, config));
}
public void testORACLE() throws Exception {
Assert.assertTrue(WallUtils.isValidateOracle(sql, config));
}
}