add wall test

src/main/java/com/alibaba/druid/filter/wall/WallProvider.java

@@ -1,9 +1,11 @@
 package com.alibaba.druid.filter.wall;
 
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 
 import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.parser.NotAllowCommentException;
 import com.alibaba.druid.sql.parser.SQLStatementParser;
 import com.alibaba.druid.sql.parser.Token;
 
@@ -30,7 +32,7 @@ public abstract class WallProvider {
         if (whiteList == null) {
             return false;
         }
-        
+
         return whiteList.get(sql) != null;
     }
 
@@ -48,8 +50,19 @@ public abstract class WallProvider {
         SQLStatementParser parser = createParser(sql);
         parser.getLexer().setAllowComment(false); // permit comment
 
-        List<SQLStatement> statementList = parser.parseStatementList();
-        if(parser.getLexer().token() != Token.EOF) {
+        List<SQLStatement> statementList = new ArrayList<SQLStatement>();
+
+        try {
+            parser.parseStatementList(statementList);
+        } catch (NotAllowCommentException e) {
+            if (throwException) {
+                throw new WallRuntimeException("not allow comment : " + sql);
+            }
+
+            return false;
+        }
+
+        if (parser.getLexer().token() != Token.EOF) {
             if (throwException) {
                 throw new WallRuntimeException("illegal statement : " + sql);
             }

src/main/java/com/alibaba/druid/sql/dialect/hive/parser/HiveLexer.java

@@ -5,6 +5,7 @@ import java.util.Map;
 
 import com.alibaba.druid.sql.parser.Keywords;
 import com.alibaba.druid.sql.parser.Lexer;
+import com.alibaba.druid.sql.parser.NotAllowCommentException;
 import com.alibaba.druid.sql.parser.Token;
 
 public class HiveLexer extends Lexer {
@@ -147,9 +148,17 @@ public class HiveLexer extends Lexer {
                 stringVal = new String(buf, np, sp);
                 token = Token.MULTI_LINE_COMMENT;
             }
+            
+            if (token != Token.HINT && !isAllowComment()) {
+                throw new NotAllowCommentException();
+            }
 
             return;
         }
+        
+        if (!isAllowComment()) {
+            throw new NotAllowCommentException();
+        }
 
         if (ch == '/') {
             scanChar();

src/main/java/com/alibaba/druid/sql/dialect/oracle/parser/OracleLexer.java

@@ -7,6 +7,7 @@ import java.util.Map;
 
 import com.alibaba.druid.sql.parser.Keywords;
 import com.alibaba.druid.sql.parser.Lexer;
+import com.alibaba.druid.sql.parser.NotAllowCommentException;
 import com.alibaba.druid.sql.parser.SQLParseException;
 import com.alibaba.druid.sql.parser.Token;
 
@@ -257,9 +258,17 @@ public class OracleLexer extends Lexer {
                 stringVal = new String(buf, np, sp);
                 token = Token.MULTI_LINE_COMMENT;
             }
+            
+            if (token != Token.HINT && !isAllowComment()) {
+                throw new NotAllowCommentException();
+            }
 
             return;
         }
+        
+        if (!isAllowComment()) {
+            throw new NotAllowCommentException();
+        }
 
         if (ch == '/' || ch == '-') {
             scanChar();

src/test/java/com/alibaba/druid/bvt/filter/wall/WallLineCommentTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 测试单行注释的场景
+ * @author admin
+ *
+ */
+public class WallLineCommentTest extends TestCase {
+    private String sql = "select f1 from t -- ";
+    
+    public void testOracle() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+    
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiLineCommentTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 测试多行注释的场景
+ * @author admin
+ *
+ */
+public class WallMultiLineCommentTest extends TestCase {
+    private String sql = "select f1 from t /* xx */ ";
+    
+    public void testOracle() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+    
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallMultiStatementTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 测试禁止多条语句执行的场景
+ * @author admin
+ *
+ */
+public class WallMultiStatementTest extends TestCase {
+    private String sql = "SELECT email FROM members WHERE email = 'x'; UPDATE members SET email = 'steve@unixwiz.net' WHERE email = 'bob@example.com';";
+    
+    public void testOracle() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+    
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+}