From f1caa4930dd976f21d58d173a639a3655b1dffdd Mon Sep 17 00:00:00 2001 From: wenshao Date: Wed, 10 Apr 2013 02:06:58 +0800 Subject: [PATCH] improve wall filter --- .../MySqlShowCreateTableStatement.java | 7 ++- .../druid/sql/visitor/SQLEvalVisitor.java | 7 ++- .../alibaba/druid/wall/WallSqlTableStat.java | 14 ++++- .../druid/wall/spi/MySqlWallVisitor.java | 16 +++++ .../druid/wall/spi/WallVisitorUtils.java | 62 +++++++++++++++++-- .../bvt/filter/wall/DoPrivilegedTest.java | 4 +- .../wall/MySqlWallPermitFunctionTest.java | 8 +-- .../wall/MySqlWallPermitVariantTest.java | 4 +- .../druid/bvt/filter/wall/MySqlWallTest.java | 8 +-- .../bvt/filter/wall/MySqlWallTest19.java | 7 ++- .../bvt/filter/wall/MySqlWallTest47.java | 2 +- .../bvt/filter/wall/MySqlWallTest54.java | 8 +-- .../bvt/filter/wall/MySqlWallTest59.java | 46 ++++++++++++++ .../bvt/filter/wall/MySqlWallTest60.java | 44 +++++++++++++ .../bvt/filter/wall/MySqlWallTest61.java | 56 +++++++++++++++++ .../bvt/filter/wall/MySqlWallTest62.java | 55 ++++++++++++++++ .../bvt/filter/wall/MySqlWallTest63.java | 45 ++++++++++++++ .../bvt/filter/wall/MySqlWallTest64.java | 47 ++++++++++++++ .../bvt/filter/wall/MySqlWallTest65.java | 47 ++++++++++++++ .../wall/OracleWallPermitSchemaTest.java | 16 ++--- .../wall/OracleWallPermitTableTest.java | 10 +-- .../druid/bvt/filter/wall/OracleWallTest.java | 4 +- .../wall/SQLServerWallPermitSchemaTest.java | 54 ++++++++-------- .../wall/SQLServerWallPermitTableTest.java | 8 +-- .../bvt/filter/wall/WallDenySchemaTest.java | 2 +- .../bvt/filter/wall/WallDenyTableTest.java | 2 +- 26 files changed, 504 insertions(+), 79 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest59.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest60.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest61.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest64.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest65.java diff --git a/src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowCreateTableStatement.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowCreateTableStatement.java index a0c8b4d097..fdfe4407cb 100644 --- a/src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowCreateTableStatement.java +++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowCreateTableStatement.java @@ -35,8 +35,11 @@ public class MySqlShowCreateTableStatement extends MySqlStatementImpl implements return name; } - public void setName(SQLExpr functionName) { - this.name = functionName; + public void setName(SQLExpr name) { + if (name != null) { + name.setParent(this); + } + this.name = name; } } diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitor.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitor.java index 5c3d44d5b7..2efaf59b16 100644 --- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitor.java +++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitor.java @@ -21,9 +21,10 @@ import com.alibaba.druid.sql.visitor.functions.Function; public interface SQLEvalVisitor extends SQLASTVisitor { - public static final String EVAL_VALUE = "eval.value"; - public static final String EVAL_EXPR = "eval.expr"; - public static final Object EVAL_ERROR = new Object(); + public static final String EVAL_VALUE = "eval.value"; + public static final String EVAL_EXPR = "eval.expr"; + public static final Object EVAL_ERROR = new Object(); + public static final Object EVAL_VALUE_COUNT = new Object(); Function getFunction(String funcName); diff --git a/src/main/java/com/alibaba/druid/wall/WallSqlTableStat.java b/src/main/java/com/alibaba/druid/wall/WallSqlTableStat.java index 3a5883f4b4..3452766a78 100644 --- a/src/main/java/com/alibaba/druid/wall/WallSqlTableStat.java +++ b/src/main/java/com/alibaba/druid/wall/WallSqlTableStat.java @@ -27,17 +27,18 @@ public class WallSqlTableStat { private int alterCount; private int dropCount; private int replaceCount; + private int showCount; public int getReplaceCount() { return replaceCount; } - + public int incrementReplaceCount() { return replaceCount++; } public void addReplaceCount(int value) { - this.replaceCount+= value; + this.replaceCount += value; } public int getSelectCount() { @@ -147,4 +148,13 @@ public class WallSqlTableStat { public void addDropCount(int value) { this.dropCount += value; } + + + public int getShowCount() { + return showCount; + } + + public void incrementShowCount() { + this.showCount++; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index fef2c3c84c..5afedb8f98 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -52,13 +52,16 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowCreateTableStatement; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnionQuery; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement; import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor; import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter; import com.alibaba.druid.wall.Violation; import com.alibaba.druid.wall.WallConfig; +import com.alibaba.druid.wall.WallContext; import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.WallSqlTableStat; import com.alibaba.druid.wall.WallVisitor; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; @@ -360,4 +363,17 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi public boolean visit(SQLCallStatement x) { return false; } + + @Override + public boolean visit(MySqlShowCreateTableStatement x) { + String tableName = ((SQLName) x.getName()).getSimleName(); + WallContext context = WallContext.current(); + if (context != null) { + WallSqlTableStat tableStat = context.getTableStat(tableName); + if (tableStat != null) { + tableStat.incrementShowCount(); + } + } + return false; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 9bcb7d8511..1ceaf901f5 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -849,21 +849,21 @@ public class WallVisitorUtils { if (x == null) { return null; } - + if (x instanceof SQLSelectQueryBlock) { return (SQLSelectQueryBlock) x; } - + SQLObject parent = x.getParent(); if (parent instanceof SQLExpr) { return getQueryBlock(parent); } - + if (parent instanceof SQLSelectItem) { return getQueryBlock(parent); } - + if (parent instanceof SQLSelectQueryBlock) { return (SQLSelectQueryBlock) parent; } @@ -871,7 +871,7 @@ public class WallVisitorUtils { return null; } - public static boolean isTopNoneFromSelect(SQLExpr x) { + public static boolean isTopNoneFromSelect(SQLObject x) { if (!(x.getParent() instanceof SQLSelectItem)) { return false; } @@ -906,7 +906,11 @@ public class WallVisitorUtils { String owner = ((SQLName) x).getSimleName(); owner = WallVisitorUtils.form(owner); if (!visitor.getProvider().checkDenySchema(owner)) { - addViolation(visitor, "deny schema : " + owner, x); + boolean topSelectStatement = isTopSelectStatement(x); + + if (!topSelectStatement) { + addViolation(visitor, "deny schema : " + owner, x); + } return true; } @@ -924,6 +928,30 @@ public class WallVisitorUtils { return true; } + private static boolean isTopSelectStatement(SQLObject x) { + boolean topSelectStatement = false; + SQLObject parent = x.getParent(); + if (parent instanceof SQLPropertyExpr) { + parent = parent.getParent(); + } + if (parent instanceof SQLExprTableSource) { + parent = parent.getParent(); + } + if (parent instanceof SQLSelectQueryBlock) { + parent = parent.getParent(); + } + if (parent instanceof SQLSelect) { + parent = parent.getParent(); + } + if (parent instanceof SQLSelectStatement || parent instanceof MySqlShowStatement) { + parent = parent.getParent(); + if (parent == null) { + topSelectStatement = true; + } + } + return topSelectStatement; + } + public static boolean check(WallVisitor visitor, SQLExprTableSource x) { SQLExpr expr = x.getExpr(); @@ -969,6 +997,11 @@ public class WallVisitorUtils { } if (visitor.isDenyTable(tableName)) { + boolean isTopNoneFrom = isTopSelectStatement(x); + if (isTopNoneFrom) { + return false; + } + addViolation(visitor, "deny table : " + tableName, x); return false; } @@ -997,6 +1030,23 @@ public class WallVisitorUtils { } if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) { + boolean isTopUpdateStatement = false; + SQLObject selectParent = x.getParent(); + while (selectParent instanceof SQLUnionQuery // + || selectParent instanceof SQLJoinTableSource // + || selectParent instanceof SQLSubqueryTableSource // + || selectParent instanceof SQLSelect) { + selectParent = selectParent.getParent(); + } + + if (selectParent instanceof SQLUpdateStatement) { + isTopUpdateStatement = true; + } + + if (isTopUpdateStatement) { + return; + } + addViolation(visitor, "union query not contains 'from clause'", x); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java index 0fa2e94f7e..5df6c66e7b 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java @@ -28,7 +28,7 @@ import com.alibaba.druid.wall.WallUtils; public class DoPrivilegedTest extends TestCase { public void test_0() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os")); + Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os FROM X")); } public void test_1() throws Exception { @@ -38,7 +38,7 @@ public class DoPrivilegedTest extends TestCase { WallProvider.doPrivileged(new PrivilegedAction() { @Override public Object run() { - Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os", config)); + Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config)); return null; } }); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java index 6c8093a161..b75ed54700 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java @@ -24,10 +24,10 @@ import com.alibaba.druid.wall.WallUtils; public class MySqlWallPermitFunctionTest extends TestCase { public void test_permitTable() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM mysql.user")); - Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM `mysql`.`user`")); - Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM \"mysql\".\"user\"")); - Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM MYSQL.USER")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM mysql.user")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM `mysql`.`user`")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM \"mysql\".\"user\"")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM MYSQL.USER")); } public void test_permitTable_subquery() throws Exception { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java index 222cac5716..358506609e 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java @@ -33,13 +33,13 @@ public class MySqlWallPermitVariantTest extends TestCase { WallConfig config = new WallConfig(); config.setVariantCheck(false); - Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os", config)); + Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config)); } public void test_not_allow() throws Exception { WallConfig config = new WallConfig(); config.setVariantCheck(true); - Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os", config)); + Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java index 04ba6f5779..5997686cc4 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java @@ -24,8 +24,8 @@ import com.alibaba.druid.wall.WallUtils; public class MySqlWallTest extends TestCase { public void testWall() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1")); - Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os'")); + Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X")); + Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os' FROM X")); Assert.assertFalse(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))")); Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'")); @@ -33,10 +33,10 @@ public class MySqlWallTest extends TestCase { Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X")); Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'")); - Assert.assertFalse(WallUtils.isValidateMySql("select 1 from information_schema.columns")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns")); Assert.assertTrue(WallUtils.isValidateMySql("select 'information_schema.columns'")); - Assert.assertFalse(WallUtils.isValidateMySql("select 1 from mysql.user")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from mysql.user")); Assert.assertTrue(WallUtils.isValidateMySql("select 'mysql.user'")); Assert.assertFalse(WallUtils.isValidateMySql("select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java index afb2425acf..05c6c71438 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java @@ -31,7 +31,12 @@ import com.alibaba.druid.wall.WallUtils; public class MySqlWallTest19 extends TestCase { public void test_true() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql(// + Assert.assertTrue(WallUtils.isValidateMySql(// "select @@basedir")); // } + + public void test_false() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(// + "select @@basedir FROM X")); // + } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java index 1bc53c8f22..b38a9855f6 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java @@ -42,6 +42,6 @@ public class MySqlWallTest47 extends TestCase { "set Fans.score = Fans.score+temp.Score " + // "where Fans.FansID = 382885 and Fans.UserID = temp.ToID")); - Assert.assertEquals(3, provider.getTableStats().size()); + Assert.assertEquals(1, provider.getTableStats().size()); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest54.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest54.java index 9b61c8cf22..7d8aa84453 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest54.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest54.java @@ -36,17 +36,17 @@ public class MySqlWallTest54 extends TestCase { provider.getConfig().setSchemaCheck(false); Assert.assertTrue(provider.checkValid(// - "select `ENGINE`, `SUPPORT` from information_schema.Engines")); + "SELECT *FROM T UNION select `ENGINE`, `SUPPORT` from information_schema.Engines")); - Assert.assertEquals(1, provider.getTableStats().size()); + Assert.assertEquals(2, provider.getTableStats().size()); } public void test_false() throws Exception { WallProvider provider = new MySqlWallProvider(); Assert.assertFalse(provider.checkValid(// - "select `ENGINE`, `SUPPORT` from information_schema.Engines")); + "SELECT *FROM T UNION select `ENGINE`, `SUPPORT` from information_schema.Engines")); - Assert.assertEquals(1, provider.getTableStats().size()); + Assert.assertEquals(2, provider.getTableStats().size()); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest59.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest59.java new file mode 100644 index 0000000000..27e789813b --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest59.java @@ -0,0 +1,46 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest59 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertTrue(provider.checkValid(// + "SELECT * FROM mysql.proc " + // + "WHERE 1=1 AND db LIKE 'dsmessagedb001'" + // + " AND name LIKE 'Proc_getRemindinfoByRemindFlag'")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest60.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest60.java new file mode 100644 index 0000000000..f4c89786c1 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest60.java @@ -0,0 +1,44 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest60 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertTrue(provider.checkValid(// + "show create table `mysql`.`help_relation`")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest61.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest61.java new file mode 100644 index 0000000000..9c2c341448 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest61.java @@ -0,0 +1,56 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest61 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertTrue(provider.checkValid(// + "SELECT * FROM `information_schema`.`columns` WHERE TABLE_NAME='aaaa' AND TABLE_SCHEMA='xxxx'")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertFalse(provider.checkValid(// + "SELECT * FROM T " + // + "UNION " + // + "SELECT * FROM `information_schema`.`columns` WHERE TABLE_NAME='aaaa' AND TABLE_SCHEMA='xxxx'")); + + Assert.assertEquals(2, provider.getTableStats().size()); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java new file mode 100644 index 0000000000..2f54b0b26b --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java @@ -0,0 +1,55 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest62 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertTrue(provider.checkValid(// + "select temp.*, u.CanComment, u.CanBeShared, u.CanForward, COALESCE(b.UserID,0) as isBlocked" + // + " , COALESCE(f.UserID,0) as Followed, COALESCE(ff.UserID,0) as IsFollowed" + // + " , COALESCE(ul.UserID,0) as liked, COALESCE(fff.UserID,0) as RIsFollowed " + // + "from (select 294765 as UserID, 0 as RUserID, 7785977 as PicID " + // + " union all select 294765 as UserID, 0 as RUserID, 7780341 as PicID) temp " + // + "left join Users as u on u.UserID = temp.UserID " + // + "left join BlockUser as b on b.UserID = temp.UserID and b.BlockUserID = 294765 " + // + "left join Fans as f on f.FansID = temp.UserID and f.UserID = 294765 " + // + "left join Fans as ff ON ff.FansID = 294765 and ff.UserID = temp.UserID " + // + "left join Fans as fff ON fff.FansID = 294765 and fff.UserID = temp.RUserID " + // + "left join UserLikes as ul on ul.PicID = temp.PicID and ul.UserID = 294765")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java new file mode 100644 index 0000000000..0003163304 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java @@ -0,0 +1,45 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest63 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertFalse(provider.checkValid(// + "SELECT FID, FNAME FROM T UNION SELECT 1, 'AAA'")); + + Assert.assertEquals(1, provider.getTableStats().size()); + } + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest64.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest64.java new file mode 100644 index 0000000000..ebf9093153 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest64.java @@ -0,0 +1,47 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest64 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertFalse(provider.checkValid(// + "SELECT email, passwd, login_id, full_name" + + " FROM members" + + " WHERE member_id = 3 AND 1=(SELECT COUNT(*) FROM tabname);'")); + + Assert.assertEquals(2, provider.getTableStats().size()); + } + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest65.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest65.java new file mode 100644 index 0000000000..e48044a385 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest65.java @@ -0,0 +1,47 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest65 extends TestCase { + + public void test_false() throws Exception { + WallProvider provider = new MySqlWallProvider(); + provider.getConfig().setSchemaCheck(true); + + Assert.assertFalse(provider.checkValid(// + "SELECT email, passwd, login_id, full_name" + + " FROM members" + + " WHERE member_id = 3 AND 0<(SELECT COUNT(*) FROM tabname);'")); + + Assert.assertEquals(2, provider.getTableStats().size()); + } + + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitSchemaTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitSchemaTest.java index 418886fa5a..78e242ebb0 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitSchemaTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitSchemaTest.java @@ -21,16 +21,16 @@ import org.junit.Assert; import com.alibaba.druid.wall.WallUtils; -/** - * 这个场景测试访问Oracle系统对象 - * - * @author admin - */ public class OracleWallPermitSchemaTest extends TestCase { - public void test_permitTable() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select banner from sys.v_$version where rownum=1")); - Assert.assertFalse(WallUtils.isValidateOracle("select banner from sys.v where rownum=1")); + public void test_true() throws Exception { + Assert.assertTrue(WallUtils.isValidateOracle("select banner from sys.v_$version where rownum=1")); + Assert.assertTrue(WallUtils.isValidateOracle("select banner from sys.v where rownum=1")); + } + + public void test_false() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select banner from sys.v_$version where rownum=1")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select banner from sys.v where rownum=1")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java index d19a1db7c8..6b341b95b2 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java @@ -24,12 +24,12 @@ import com.alibaba.druid.wall.WallUtils; public class OracleWallPermitTableTest extends TestCase { public void test_permitTable() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select * from TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from tab")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.\"TAB\"")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from tab")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.TAB")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.\"TAB\"")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from all_users")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from all_users")); } public void test_permitTable_subquery() throws Exception { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java index c914fad127..95ac54367a 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java @@ -26,7 +26,7 @@ public class OracleWallTest extends TestCase { public void testWall() throws Exception { Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from TAB")); - Assert.assertFalse(WallUtils.isValidateOracle("select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java index ed71a174a5..fdeb2018f8 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java @@ -53,32 +53,32 @@ public class SQLServerWallPermitSchemaTest extends TestCase { public void test_master() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password FROM master..sysxlogins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’);")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE denylogin = 0;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE hasaccess = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE isntname = 0;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE isntgroup = 0;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE securityadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE serveradmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE setupadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE processadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE diskadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE dbcreator = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE bulkadmin = 1;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = ’1′ ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysdatabases;")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password_hash FROM master.sys.sql_logins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, password FROM master..sysxlogins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE denylogin = 0;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE hasaccess = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE isntname = 0;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE isntgroup = 0;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE sysadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE securityadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE serveradmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE setupadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE processadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE diskadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE dbcreator = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE bulkadmin = 1;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE sysadmin = ’1′ ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..sysdatabases;")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, password_hash FROM master.sys.sql_logins")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java index bc445f5def..721c3c5992 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java @@ -30,14 +30,14 @@ import com.alibaba.druid.wall.WallUtils; */ public class SQLServerWallPermitTableTest extends TestCase { public void test01() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysObjects")); - Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysObjects")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysdatabases")); } public void test03() throws Exception { - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); - Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ ")); + Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);")); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenySchemaTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenySchemaTest.java index 846426a250..1f17f6fa4a 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenySchemaTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenySchemaTest.java @@ -27,7 +27,7 @@ import com.alibaba.druid.wall.spi.OracleWallProvider; public class WallDenySchemaTest extends TestCase { public void testORACLE() throws Exception { - String sql = "SELECT F1, F2 FROM ALL_ALL_TABLES"; + String sql = "SELECT * FROM T UNION SELECT F1, F2 FROM ALL_ALL_TABLES"; OracleWallProvider provider = new OracleWallProvider(); Assert.assertFalse(provider.checkValid(sql)); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenyTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenyTableTest.java index c93ed910a2..21a4989c35 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenyTableTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenyTableTest.java @@ -27,7 +27,7 @@ import com.alibaba.druid.wall.spi.OracleWallProvider; public class WallDenyTableTest extends TestCase { public void testORACLE() throws Exception { - String sql = "SELECT F1, F2 FROM SYS.ABC"; + String sql = "SELECT *FROM T UNION SELECT F1, F2 FROM SYS.ABC"; OracleWallProvider provider = new OracleWallProvider(); Assert.assertFalse(provider.checkValid(sql));