improve wall filter

src/main/java/com/alibaba/druid/sql/dialect/mysql/ast/statement/MySqlShowCreateTableStatement.java

@@ -35,8 +35,11 @@ public class MySqlShowCreateTableStatement extends MySqlStatementImpl implements
         return name;
     }
 
-    public void setName(SQLExpr functionName) {
-        this.name = functionName;
+    public void setName(SQLExpr name) {
+        if (name != null) {
+            name.setParent(this);
+        }
+        this.name = name;
     }
 
 }

src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitor.java

@@ -21,9 +21,10 @@ import com.alibaba.druid.sql.visitor.functions.Function;
 
 public interface SQLEvalVisitor extends SQLASTVisitor {
 
-    public static final String EVAL_VALUE = "eval.value";
-    public static final String EVAL_EXPR  = "eval.expr";
-    public static final Object EVAL_ERROR = new Object();
+    public static final String EVAL_VALUE       = "eval.value";
+    public static final String EVAL_EXPR        = "eval.expr";
+    public static final Object EVAL_ERROR       = new Object();
+    public static final Object EVAL_VALUE_COUNT = new Object();
 
     Function getFunction(String funcName);
 

src/main/java/com/alibaba/druid/wall/WallSqlTableStat.java

@@ -27,17 +27,18 @@ public class WallSqlTableStat {
     private int alterCount;
     private int dropCount;
     private int replaceCount;
+    private int showCount;
 
     public int getReplaceCount() {
         return replaceCount;
     }
-    
+
     public int incrementReplaceCount() {
         return replaceCount++;
     }
 
     public void addReplaceCount(int value) {
-        this.replaceCount+= value;
+        this.replaceCount += value;
     }
 
     public int getSelectCount() {
@@ -147,4 +148,13 @@ public class WallSqlTableStat {
     public void addDropCount(int value) {
         this.dropCount += value;
     }
+
+    
+    public int getShowCount() {
+        return showCount;
+    }
+    
+    public void incrementShowCount() {
+        this.showCount++;
+    }
 }

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -52,13 +52,16 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
+import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlShowCreateTableStatement;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUnionQuery;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlUpdateStatement;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter;
 import com.alibaba.druid.wall.Violation;
 import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallContext;
 import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.WallSqlTableStat;
 import com.alibaba.druid.wall.WallVisitor;
 import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
 
@@ -360,4 +363,17 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
     public boolean visit(SQLCallStatement x) {
         return false;
     }
+    
+    @Override
+    public boolean visit(MySqlShowCreateTableStatement x) {
+        String tableName = ((SQLName) x.getName()).getSimleName();
+        WallContext context = WallContext.current();
+        if (context != null) {
+            WallSqlTableStat tableStat = context.getTableStat(tableName);
+            if (tableStat != null) {
+                tableStat.incrementShowCount();
+            }
+        }
+        return false;
+    }
 }

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -849,21 +849,21 @@ public class WallVisitorUtils {
         if (x == null) {
             return null;
         }
-        
+
         if (x instanceof SQLSelectQueryBlock) {
             return (SQLSelectQueryBlock) x;
         }
-        
+
         SQLObject parent = x.getParent();
 
         if (parent instanceof SQLExpr) {
             return getQueryBlock(parent);
         }
-        
+
         if (parent instanceof SQLSelectItem) {
             return getQueryBlock(parent);
         }
-        
+
         if (parent instanceof SQLSelectQueryBlock) {
             return (SQLSelectQueryBlock) parent;
         }
@@ -871,7 +871,7 @@ public class WallVisitorUtils {
         return null;
     }
 
-    public static boolean isTopNoneFromSelect(SQLExpr x) {
+    public static boolean isTopNoneFromSelect(SQLObject x) {
         if (!(x.getParent() instanceof SQLSelectItem)) {
             return false;
         }
@@ -906,7 +906,11 @@ public class WallVisitorUtils {
             String owner = ((SQLName) x).getSimleName();
             owner = WallVisitorUtils.form(owner);
             if (!visitor.getProvider().checkDenySchema(owner)) {
-                addViolation(visitor, "deny schema : " + owner, x);
+                boolean topSelectStatement = isTopSelectStatement(x);
+
+                if (!topSelectStatement) {
+                    addViolation(visitor, "deny schema : " + owner, x);
+                }
                 return true;
             }
 
@@ -924,6 +928,30 @@ public class WallVisitorUtils {
         return true;
     }
 
+    private static boolean isTopSelectStatement(SQLObject x) {
+        boolean topSelectStatement = false;
+        SQLObject parent = x.getParent();
+        if (parent instanceof SQLPropertyExpr) {
+            parent = parent.getParent();
+        }
+        if (parent instanceof SQLExprTableSource) {
+            parent = parent.getParent();
+        }
+        if (parent instanceof SQLSelectQueryBlock) {
+            parent = parent.getParent();
+        }
+        if (parent instanceof SQLSelect) {
+            parent = parent.getParent();
+        }
+        if (parent instanceof SQLSelectStatement || parent instanceof MySqlShowStatement) {
+            parent = parent.getParent();
+            if (parent == null) {
+                topSelectStatement = true;
+            }
+        }
+        return topSelectStatement;
+    }
+
     public static boolean check(WallVisitor visitor, SQLExprTableSource x) {
         SQLExpr expr = x.getExpr();
 
@@ -969,6 +997,11 @@ public class WallVisitorUtils {
             }
 
             if (visitor.isDenyTable(tableName)) {
+                boolean isTopNoneFrom = isTopSelectStatement(x);
+                if (isTopNoneFrom) {
+                    return false;
+                }
+                
                 addViolation(visitor, "deny table : " + tableName, x);
                 return false;
             }
@@ -997,6 +1030,23 @@ public class WallVisitorUtils {
         }
 
         if (WallVisitorUtils.queryBlockFromIsNull(x.getLeft()) || WallVisitorUtils.queryBlockFromIsNull(x.getRight())) {
+            boolean isTopUpdateStatement = false;
+            SQLObject selectParent = x.getParent();
+            while (selectParent instanceof SQLUnionQuery //
+                   || selectParent instanceof SQLJoinTableSource //
+                   || selectParent instanceof SQLSubqueryTableSource //
+                   || selectParent instanceof SQLSelect) {
+                selectParent = selectParent.getParent();
+            }
+
+            if (selectParent instanceof SQLUpdateStatement) {
+                isTopUpdateStatement = true;
+            }
+
+            if (isTopUpdateStatement) {
+                return;
+            }
+
             addViolation(visitor, "union query not contains 'from clause'", x);
         }
     }