diff --git a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java index 9d41e09719..f97f88d18a 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/filter/wall/WallConfig.java @@ -9,11 +9,14 @@ import com.alibaba.druid.filter.wall.spi.WallVisitorUtils; public class WallConfig { + private boolean noneBaseStatementAllow = false; + private boolean selelctAllow = true; private boolean selectIntoAllow = true; private boolean selectIntoOutfileAllow = false; private boolean selectWhereAlwayTrueCheck = true; private boolean selectHavingAlwayTrueCheck = true; + private boolean selectUnionCheck = true; private boolean deleteAllow = true; private boolean deleteWhereAlwayTrueCheck = true; @@ -75,6 +78,14 @@ public class WallConfig { loadResource(getPermitObjects(), dir + "/permit-object.txt"); } + public boolean isNoneBaseStatementAllow() { + return noneBaseStatementAllow; + } + + public void setNoneBaseStatementAllow(boolean noneBaseStatementAllow) { + this.noneBaseStatementAllow = noneBaseStatementAllow; + } + public boolean isSelelctAllow() { return selelctAllow; } @@ -99,6 +110,14 @@ public class WallConfig { this.selectIntoOutfileAllow = selectIntoOutfileAllow; } + public boolean isSelectUnionCheck() { + return selectUnionCheck; + } + + public void setSelectUnionCheck(boolean selectUnionCheck) { + this.selectUnionCheck = selectUnionCheck; + } + public boolean isSelectWhereAlwayTrueCheck() { return selectWhereAlwayTrueCheck; } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java index e3703a2f73..907e0398b4 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java @@ -176,9 +176,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(SQLUnionQuery x) { - if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); - } + WallVisitorUtils.checkUnion(this, x); return true; } @@ -202,6 +200,10 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi if (!(x instanceof SQLStatement)) { return; } + + if (config.isNoneBaseStatementAllow()) { + return; + } if (x instanceof SQLInsertStatement) { diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java index 95e668981f..b72a1be59f 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java @@ -16,7 +16,6 @@ import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr; import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; -import com.alibaba.druid.sql.ast.statement.SQLDropTableStatement; import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; @@ -65,11 +64,6 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi return true; } - public boolean visit(SQLDropTableStatement x) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toOracleString(x))); - return false; - } - @Override public boolean visit(SQLMethodInvokeExpr x) { WallVisitorUtils.checkFunction(this, x); @@ -113,9 +107,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi @Override public boolean visit(SQLUnionQuery x) { - if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); - } + WallVisitorUtils.checkUnion(this, x); return true; } @@ -143,6 +135,10 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi return; } + if (config.isNoneBaseStatementAllow()) { + return; + } + if (x instanceof SQLInsertStatement) { } else if (x instanceof SQLSelectStatement) { @@ -154,7 +150,7 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi } else if (x instanceof OracleMergeStatement) { } else { - violations.add(new IllegalSQLObjectViolation(SQLUtils.toMySqlString(x))); + violations.add(new IllegalSQLObjectViolation(toSQL(x))); } } diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java index 922614fab9..86bcb5417e 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java @@ -14,6 +14,7 @@ import com.alibaba.druid.logging.Log; import com.alibaba.druid.logging.LogFactory; import com.alibaba.druid.sql.ast.SQLExpr; import com.alibaba.druid.sql.ast.SQLName; +import com.alibaba.druid.sql.ast.SQLObject; import com.alibaba.druid.sql.ast.expr.SQLAggregateExpr; import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr; import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; @@ -36,6 +37,7 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectQuery; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSubqueryTableSource; import com.alibaba.druid.sql.ast.statement.SQLTableSource; +import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlBooleanExpr; import com.alibaba.druid.util.JdbcUtils; @@ -49,17 +51,17 @@ public class WallVisitorUtils { String owner = x.getOwner().toString(); owner = WallVisitorUtils.form(owner); if (visitor.getConfig().isPermitObjects(owner)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } } public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) { if (!visitor.getConfig().isSelectIntoAllow() && x.getInto() != null) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } - + if (!visitor.getConfig().isSelectWhereAlwayTrueCheck()) { return; } @@ -77,7 +79,7 @@ public class WallVisitorUtils { } } - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -91,13 +93,13 @@ public class WallVisitorUtils { } if (Boolean.TRUE == getValue(x)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } public static void checkDelete(WallVisitor visitor, SQLDeleteStatement x) { if (!visitor.getConfig().isDeleteAllow()) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } @@ -106,13 +108,13 @@ public class WallVisitorUtils { } if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } public static void checkUpdate(WallVisitor visitor, SQLUpdateStatement x) { if (!visitor.getConfig().isUpdateAllow()) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); return; } @@ -121,7 +123,7 @@ public class WallVisitorUtils { } if (x.getWhere() == null || Boolean.TRUE == getValue(x.getWhere())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -397,7 +399,7 @@ public class WallVisitorUtils { String owner = x.getOwner().toString(); owner = WallVisitorUtils.form(owner); if (visitor.getConfig().isPermitObjects(owner)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -408,7 +410,7 @@ public class WallVisitorUtils { String methodName = x.getMethodName(); if (visitor.getConfig().isPermitFunction(methodName.toLowerCase())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -426,7 +428,7 @@ public class WallVisitorUtils { ownerName = form(ownerName); if (visitor.getConfig().getPermitSchemas().contains(ownerName.toLowerCase())) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } @@ -440,11 +442,25 @@ public class WallVisitorUtils { if (tableName != null) { tableName = form(tableName); if (visitor.containsPermitTable(tableName)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + addViolation(visitor, x); } } } + private static void addViolation(WallVisitor visitor, SQLObject x) { + visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); + } + + public static void checkUnion(WallVisitor visitor, SQLUnionQuery x) { + if (!visitor.getConfig().isSelectUnionCheck()) { + return; + } + + if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) { + addViolation(visitor, x); + } + } + public static boolean queryBlockFromIsNull(SQLSelectQuery query) { if (query instanceof SQLSelectQueryBlock) { SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) query; diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java new file mode 100644 index 0000000000..7f15a29bfa --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDropTest1.java @@ -0,0 +1,32 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallConfig; +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测 + * @author wenshao + * + */ +public class WallDropTest1 extends TestCase { + private String sql = "DROP TABLE T1"; + + private WallConfig config = new WallConfig(); + + protected void setUp() throws Exception { + config.setNoneBaseStatementAllow(true); + } + + public void testMySql() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(sql, config)); + } + + public void testORACLE() throws Exception { + + Assert.assertTrue(WallUtils.isValidateOracle(sql, config)); + } +}