improve wall filter

src/test/java/com/alibaba/druid/bvt/filter/wall/DoPrivilegedTest.java

@@ -28,7 +28,7 @@ import com.alibaba.druid.wall.WallUtils;
 public class DoPrivilegedTest extends TestCase {
 
     public void test_0() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os  FROM X"));
     }
 
     public void test_1() throws Exception {
@@ -38,7 +38,7 @@ public class DoPrivilegedTest extends TestCase {
         WallProvider.doPrivileged(new PrivilegedAction<Object>() {
             @Override
             public Object run() {
-                Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os", config));
+                Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config));
                 return null;
             }
         });

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitFunctionTest.java

@@ -24,10 +24,10 @@ import com.alibaba.druid.wall.WallUtils;
 public class MySqlWallPermitFunctionTest extends TestCase {
 
     public void test_permitTable() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM mysql.user"));
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM `mysql`.`user`"));
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM \"mysql\".\"user\""));
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT User,Password FROM MYSQL.USER"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM mysql.user"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM `mysql`.`user`"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM \"mysql\".\"user\""));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION SELECT User,Password FROM MYSQL.USER"));
     }
     
     public void test_permitTable_subquery() throws Exception {

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitVariantTest.java

@@ -33,13 +33,13 @@ public class MySqlWallPermitVariantTest extends TestCase {
         WallConfig config = new WallConfig();
         config.setVariantCheck(false);
         
-        Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os", config));
+        Assert.assertTrue(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config));
     }
     
     public void test_not_allow() throws Exception {
         WallConfig config = new WallConfig();
         config.setVariantCheck(true);
         
-        Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os", config));
+        Assert.assertFalse(WallUtils.isValidateMySql("select @@version_compile_os FROM X", config));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java

@@ -24,8 +24,8 @@ import com.alibaba.druid.wall.WallUtils;
 public class MySqlWallTest extends TestCase {
 
     public void testWall() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1"));
-        Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os'"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select 14,13,12,11,10,@@version_compile_os,8,7,6,5,4,3,2,1 FROM X"));
+        Assert.assertTrue(WallUtils.isValidateMySql("select '@@version_compile_os' FROM X"));
 
         Assert.assertFalse(WallUtils.isValidateMySql("select hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'hex(load_file(0x633A2F77696E646F77732F7265706169722F73616D))'"));
@@ -33,10 +33,10 @@ public class MySqlWallTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateMySql("select 15,version() FROM X"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 15,'version'"));
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select 1 from information_schema.columns"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from information_schema.columns"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'information_schema.columns'"));
         
-        Assert.assertFalse(WallUtils.isValidateMySql("select 1 from mysql.user"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT *FROM T UNION select 1 from mysql.user"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'mysql.user'"));
         
         Assert.assertFalse(WallUtils.isValidateMySql("select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'"));

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest19.java

@@ -31,7 +31,12 @@ import com.alibaba.druid.wall.WallUtils;
 public class MySqlWallTest19 extends TestCase {
 
     public void test_true() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql(//
+        Assert.assertTrue(WallUtils.isValidateMySql(//
         "select @@basedir")); //
     }
+    
+    public void test_false() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(//
+                "select @@basedir FROM X")); //
+    }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest47.java

@@ -42,6 +42,6 @@ public class MySqlWallTest47 extends TestCase {
                 "set Fans.score = Fans.score+temp.Score " + //
                 "where Fans.FansID = 382885 and Fans.UserID = temp.ToID"));
 
-        Assert.assertEquals(3, provider.getTableStats().size());
+        Assert.assertEquals(1, provider.getTableStats().size());
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest54.java

@@ -36,17 +36,17 @@ public class MySqlWallTest54 extends TestCase {
         provider.getConfig().setSchemaCheck(false);
 
         Assert.assertTrue(provider.checkValid(//
-        "select `ENGINE`, `SUPPORT` from information_schema.Engines"));
+        "SELECT *FROM T UNION select `ENGINE`, `SUPPORT` from information_schema.Engines"));
 
-        Assert.assertEquals(1, provider.getTableStats().size());
+        Assert.assertEquals(2, provider.getTableStats().size());
     }
     
     public void test_false() throws Exception {
         WallProvider provider = new MySqlWallProvider();
         
         Assert.assertFalse(provider.checkValid(//
-                "select `ENGINE`, `SUPPORT` from information_schema.Engines"));
+                "SELECT *FROM T UNION select `ENGINE`, `SUPPORT` from information_schema.Engines"));
         
-        Assert.assertEquals(1, provider.getTableStats().size());
+        Assert.assertEquals(2, provider.getTableStats().size());
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest59.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest59 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertTrue(provider.checkValid(//
+        "SELECT * FROM mysql.proc " + //
+                "WHERE 1=1 AND db LIKE 'dsmessagedb001'" + //
+                " AND name LIKE 'Proc_getRemindinfoByRemindFlag'"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest60.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest60 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertTrue(provider.checkValid(//
+        "show create table `mysql`.`help_relation`"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest61.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest61 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertTrue(provider.checkValid(//
+        "SELECT * FROM `information_schema`.`columns` WHERE TABLE_NAME='aaaa' AND TABLE_SCHEMA='xxxx'"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT * FROM T " + //
+                "UNION " + //
+                "SELECT * FROM `information_schema`.`columns` WHERE TABLE_NAME='aaaa' AND TABLE_SCHEMA='xxxx'"));
+
+        Assert.assertEquals(2, provider.getTableStats().size());
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest62 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertTrue(provider.checkValid(//
+        "select temp.*, u.CanComment, u.CanBeShared, u.CanForward, COALESCE(b.UserID,0) as isBlocked" + //
+                "   , COALESCE(f.UserID,0) as Followed, COALESCE(ff.UserID,0) as IsFollowed" + //
+                "   , COALESCE(ul.UserID,0) as liked, COALESCE(fff.UserID,0) as RIsFollowed " + //
+                "from (select 294765 as UserID, 0  as RUserID, 7785977 as PicID " + //
+                "       union all select 294765 as UserID, 0  as RUserID, 7780341 as PicID) temp     " + //
+                "left join Users as u on u.UserID = temp.UserID   " + //
+                "left join BlockUser as b on b.UserID = temp.UserID and b.BlockUserID = 294765     " + //
+                "left join Fans as f on f.FansID = temp.UserID and f.UserID = 294765   " + //
+                "left join Fans as ff ON ff.FansID = 294765 and ff.UserID = temp.UserID   " + //
+                "left join Fans as fff ON fff.FansID = 294765 and fff.UserID = temp.RUserID   " + //
+                "left join UserLikes as ul on ul.PicID = temp.PicID and ul.UserID = 294765"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest63 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT FID, FNAME FROM T UNION SELECT 1, 'AAA'"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+    }
+
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest64.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest64 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT email, passwd, login_id, full_name" +
+        " FROM members" +
+        " WHERE member_id = 3 AND 1=(SELECT COUNT(*) FROM tabname);'"));
+
+        Assert.assertEquals(2, provider.getTableStats().size());
+    }
+
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest65.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest65 extends TestCase {
+
+    public void test_false() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        provider.getConfig().setSchemaCheck(true);
+
+        Assert.assertFalse(provider.checkValid(//
+        "SELECT email, passwd, login_id, full_name" +
+        " FROM members" +
+        " WHERE member_id = 3 AND 0<(SELECT COUNT(*) FROM tabname);'"));
+
+        Assert.assertEquals(2, provider.getTableStats().size());
+    }
+
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitSchemaTest.java

@@ -21,16 +21,16 @@ import org.junit.Assert;
 
 import com.alibaba.druid.wall.WallUtils;
 
-/**
- * 这个场景测试访问Oracle系统对象
- * 
- * @author admin
- */
 public class OracleWallPermitSchemaTest extends TestCase {
 
-    public void test_permitTable() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select banner from sys.v_$version where rownum=1"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select banner from sys.v where rownum=1"));
+    public void test_true() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateOracle("select banner from sys.v_$version where rownum=1"));
+        Assert.assertTrue(WallUtils.isValidateOracle("select banner from sys.v where rownum=1"));
+    }
+    
+    public void test_false() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select banner from sys.v_$version where rownum=1"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select banner from sys.v where rownum=1"));
     }
     
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallPermitTableTest.java

@@ -24,12 +24,12 @@ import com.alibaba.druid.wall.WallUtils;
 public class OracleWallPermitTableTest extends TestCase {
 
     public void test_permitTable() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from TAB"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from tab"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.TAB"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from SYS.\"TAB\""));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from tab"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.TAB"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from SYS.\"TAB\""));
         
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from all_users"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from all_users"));
     }
     
     public void test_permitTable_subquery() throws Exception {

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java

@@ -26,7 +26,7 @@ public class OracleWallTest extends TestCase {
     public void testWall() throws Exception {
         Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2"));
         
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from TAB"));
-        Assert.assertFalse(WallUtils.isValidateOracle("select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitSchemaTest.java

@@ -53,32 +53,32 @@ public class SQLServerWallPermitSchemaTest extends TestCase {
 
 
     public void test_master() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password FROM master..sysxlogins"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’);"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE denylogin = 0;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE hasaccess = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE isntname = 0;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE isntgroup = 0;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE securityadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE serveradmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE setupadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE processadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE diskadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE dbcreator = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE bulkadmin = 1;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins WHERE sysadmin = ’1′ "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..sysdatabases;"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM master..syslogins"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name, password_hash FROM master.sys.sql_logins"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, password FROM master..sysxlogins"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’);"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE denylogin = 0;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE hasaccess = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE isntname = 0;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE isntgroup = 0;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE sysadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE securityadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE serveradmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE setupadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE processadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE diskadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE dbcreator = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE bulkadmin = 1;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins WHERE sysadmin = ’1′ "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..sysdatabases;"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name FROM master..syslogins"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT *FROM T UNION SELECT name, password_hash FROM master.sys.sql_logins"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java

@@ -30,14 +30,14 @@ import com.alibaba.druid.wall.WallUtils;
  */
 public class SQLServerWallPermitTableTest extends TestCase {
     public void test01() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysObjects"));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysdatabases"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysObjects"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION select * from sysdatabases"));
     }
     
 
     public void test03() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ "));
-        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ "));
+        Assert.assertFalse(WallUtils.isValidateSqlServer("SELECT * FROM T UNION SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’);"));
     }
     
 

src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenySchemaTest.java

@@ -27,7 +27,7 @@ import com.alibaba.druid.wall.spi.OracleWallProvider;
 public class WallDenySchemaTest extends TestCase {
 
     public void testORACLE() throws Exception {
-        String sql = "SELECT F1, F2 FROM ALL_ALL_TABLES";
+        String sql = "SELECT * FROM T UNION SELECT F1, F2 FROM ALL_ALL_TABLES";
 
         OracleWallProvider provider = new OracleWallProvider();
         Assert.assertFalse(provider.checkValid(sql));

src/test/java/com/alibaba/druid/bvt/filter/wall/WallDenyTableTest.java

@@ -27,7 +27,7 @@ import com.alibaba.druid.wall.spi.OracleWallProvider;
 public class WallDenyTableTest extends TestCase {
 
     public void testORACLE() throws Exception {
-        String sql = "SELECT F1, F2 FROM SYS.ABC";
+        String sql = "SELECT *FROM T UNION SELECT F1, F2 FROM SYS.ABC";
 
         OracleWallProvider provider = new OracleWallProvider();
         Assert.assertFalse(provider.checkValid(sql));