Merge remote-tracking branch 'upstream/master'

This commit is contained in:
kiki
2013-09-02 11:38:33 +08:00
16 changed files with 427 additions and 14 deletions
+1 -1
View File
@@ -24,7 +24,7 @@
<junit.version>4.11</junit.version>
<gpg.skip>true</gpg.skip>
<javadoc.skip>false</javadoc.skip>
<javadoc.skip>true</javadoc.skip>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<jdk.version>1.6</jdk.version>
@@ -83,6 +83,8 @@ import com.alibaba.druid.sql.parser.Token;
public class OracleExprParser extends SQLExprParser {
public boolean allowStringAdditive = false;
/**
@@ -480,12 +482,37 @@ public class OracleExprParser extends SQLExprParser {
protected SQLExpr methodRest(SQLExpr expr, boolean acceptLPAREN) {
if (acceptLPAREN) {
accept(Token.LPAREN);
if (lexer.token() == Token.PLUS) {
lexer.nextToken();
}
if (lexer.token() == Token.PLUS) {
lexer.nextToken();
accept(Token.RPAREN);
return new OracleOuterExpr(expr);
}
if (expr instanceof SQLIdentifierExpr) {
String methodName = ((SQLIdentifierExpr) expr).getName();
SQLMethodInvokeExpr methodExpr = new SQLMethodInvokeExpr(methodName);
if ("trim".equalsIgnoreCase(methodName)) {
if (identifierEquals("LEADING") //
|| identifierEquals("TRAILING") //
|| identifierEquals("BOTH")
) {
methodExpr.putAttribute("trim_option", lexer.stringVal());
lexer.nextToken();
}
SQLExpr trim_character = this.primary();
trim_character.setParent(methodExpr);
methodExpr.putAttribute("trim_character", trim_character);
accept(Token.FROM);
SQLExpr trim_source = this.expr();
methodExpr.addParameter(trim_source);
accept(Token.RPAREN);
return new OracleOuterExpr(expr);
return primaryRest(methodExpr);
}
}
return super.methodRest(expr, false);
}
@@ -3383,4 +3383,27 @@ public class OracleOutputVisitor extends SQLASTOutputVisitor implements OracleAS
protected void printCascade() {
print(" CASCADE CONSTRAINTS");
}
@Override
public boolean visit(SQLMethodInvokeExpr x) {
if ("trim".equalsIgnoreCase(x.getMethodName())) {
SQLExpr trim_character = (SQLExpr) x.getAttribute("trim_character");
if (trim_character != null) {
print(x.getMethodName());
print("(");
String trim_option = (String) x.getAttribute("trim_option");
if (trim_option != null && trim_option.length() != 0) {
print(trim_option);
print(' ');
}
trim_character.accept(this);
print(" FROM ");
x.getParameters().get(0).accept(this);
print(")");
return false;
}
}
return super.visit(x);
}
}
@@ -365,7 +365,7 @@ public class SQLExprParser extends SQLParser {
return primaryRest(sqlExpr);
} else {
SQLExpr restExpr = equality();
SQLExpr restExpr = relational();
sqlExpr = new SQLNotExpr(restExpr);
}
break;
@@ -1032,7 +1032,7 @@ public class SchemaStatVisitor extends SQLASTVisitorAdapter {
return false;
}
public boolean visit(SQLInListExpr x) {
if (x.isNot()) {
handleCondition(x.getExpr(), "NOT IN", x.getTargetList());
@@ -42,6 +42,7 @@ public abstract class ResourceSerlvet extends HttpServlet {
public static final String PARAM_NAME_PASSWORD = "loginPassword";
public static final String PARAM_NAME_ALLOW = "allow";
public static final String PARAM_NAME_DENY = "deny";
public static final String PARAM_REMOTE_ADDR = "remoteAddress";
protected String username = null;
protected String password = null;
@@ -51,6 +52,8 @@ public abstract class ResourceSerlvet extends HttpServlet {
protected final String resourcePath;
protected String remoteAddressHeader = null;
public ResourceSerlvet(String resourcePath){
this.resourcePath = resourcePath;
}
@@ -70,6 +73,11 @@ public abstract class ResourceSerlvet extends HttpServlet {
this.password = paramPassword;
}
String paramRemoteAddressHeader = getInitParameter(PARAM_REMOTE_ADDR);
if (!StringUtils.isEmpty(paramRemoteAddressHeader)) {
this.remoteAddressHeader = paramRemoteAddressHeader;
}
try {
String param = getInitParameter(PARAM_NAME_ALLOW);
if (param != null && param.trim().length() != 0) {
@@ -218,7 +226,11 @@ public abstract class ResourceSerlvet extends HttpServlet {
if (contextPath == null || contextPath.equals("") || contextPath.equals("/")) {
response.sendRedirect("/druid/login.html");
} else {
response.sendRedirect("druid/login.html");
if ("".equals(path)) {
response.sendRedirect("druid/login.html");
} else {
response.sendRedirect("login.html");
}
}
return;
}
@@ -263,9 +275,23 @@ public abstract class ResourceSerlvet extends HttpServlet {
}
public boolean isPermittedRequest(HttpServletRequest request) {
String remoteAddress = request.getRemoteAddr();
String remoteAddress = getRemoteAddress(request);
return isPermittedRequest(remoteAddress);
}
protected String getRemoteAddress(HttpServletRequest request) {
String remoteAddr = null;
if (remoteAddressHeader != null) {
remoteAddr = request.getHeader(remoteAddressHeader);
}
if (remoteAddr == null) {
remoteAddr = request.getRemoteAddr();
}
return remoteAddr;
}
protected abstract String process(String url);
}
@@ -108,10 +108,20 @@ public class WallConfig implements WallConfigMBean {
private boolean conditionOpXorAllow = false;
private boolean conditionOpBitwseAllow = true;
private boolean caseConditionAllow = false;
public WallConfig(){
}
public boolean isCaseConditionAllow() {
return caseConditionAllow;
}
public void setCaseConditionAllow(boolean caseConditionAllow) {
this.caseConditionAllow = caseConditionAllow;
}
public boolean isConditionDoubleConstAllow() {
return conditionDoubleConstAllow;
}
@@ -44,6 +44,7 @@ import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock;
import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr;
import com.alibaba.druid.sql.dialect.sqlserver.ast.stmt.SQLServerExecStatement;
import com.alibaba.druid.sql.dialect.sqlserver.ast.stmt.SQLServerInsertStatement;
import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor;
import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitorAdapter;
@@ -152,6 +153,10 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
return true;
}
@Override
public boolean visit(SQLServerExecStatement x) {
return false;
}
public boolean visit(SQLExprTableSource x) {
WallVisitorUtils.check(this, x);
@@ -257,7 +257,7 @@ public class WallVisitorUtils {
boolean isSimpleConstExpr = false;
SQLExpr first = getFirst(where);
if (first == where) {
if (first == where || first instanceof SQLLiteralExpr) {
isSimpleConstExpr = true;
} else if (first instanceof SQLBinaryOpExpr) {
SQLBinaryOpExpr binaryOpExpr = (SQLBinaryOpExpr) first;
@@ -278,7 +278,6 @@ public class WallVisitorUtils {
addViolation(visitor, ErrorCode.ALWAY_TRUE, "select alway true condition not allow", x);
}
}
}
checkConditionForMultiTenant(visitor, x.getWhere(), x);
} finally {
@@ -1046,9 +1045,18 @@ public class WallVisitorUtils {
return SQLEvalVisitorUtils.eval(dbType, x, Collections.emptyList(), false);
}
if (x instanceof SQLCaseExpr) {
if (visitor != null && (!visitor.getConfig().isCaseConditionAllow()) && x instanceof SQLCaseExpr) {
SQLCaseExpr caseExpr = (SQLCaseExpr) x;
if (caseExpr.getItems().size() > 0) {
boolean leftIsName = false;
if (caseExpr.getParent() instanceof SQLBinaryOpExpr) {
SQLExpr left = ((SQLBinaryOpExpr) caseExpr.getParent()).getLeft();
if (left instanceof SQLName) {
leftIsName = true;
}
}
if ((!leftIsName) && caseExpr.getItems().size() > 0) {
SQLCaseExpr.Item item = caseExpr.getItems().get(0);
Object conditionVal = getValue(visitor, item.getConditionExpr());
Object itemVal = getValue(visitor, item.getValueExpr());
@@ -28,13 +28,13 @@
{{~ it.Content :datasourceNow:i }}
<ul class="nav nav-tabs" id="datasourceTab">
<li class="active">
<a href="datasource.html#dstab{{=datasourceNow.Identity}}">DataSource-{{=datasourceNow.Identity}}</a>
<a href="datasource.html#dstab{{=datasourceNow.Identity}}">{{=datasourceNow.Name}}</a>
</li>
</ul>
<div class="tab-content">
<div class="tab-pane active" id="dstab{{=datasourceNow.Identity}}">
<h4>
Basic Info For DataSource-{{=datasourceNow.Identity}}<a href="datasource-{{=datasourceNow.Identity}}.json" target="_blank" >View JSON API</a>
Basic Info For {{=datasourceNow.Name}}<a href="datasource-{{=datasourceNow.Identity}}.json" target="_blank" >View JSON API</a>
</h4>
<table class="table table-bordered" style="background-color: #fff">
<tbody>
@@ -0,0 +1,33 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.MySqlWallProvider;
public class MySqlWallTest142 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
String sql = "SELECT * FROM `my_crons` WHERE 1 OR nextrun = '0' ";
Assert.assertTrue(provider.checkValid(sql));
}
}
@@ -0,0 +1,46 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.MySqlWallProvider;
public class MySqlWallTest143 extends TestCase {
public void test_false() throws Exception {
WallProvider provider = new MySqlWallProvider();
String sql = "SELECT" //
+ " `Extent1`.`ID`, " //
+ " `Extent1`.`State`, " //
+ " `Extent1`.`CreateTime`, " //
+ " `Extent1`.`UpdateTime`, " //
+ " `Extent1`.`OpeningBank`, " //
+ " `Extent1`.`BankAccount`, " //
+ " `Extent1`.`BankAccountName`, " //
+ " `Extent1`.`Zone`, " //
+ " `Extent1`.`AccountantMobile`, " //
+ " `Extent1`.`IsPublic`" //
+ " FROM `paybank` AS `Extent1`" //
+ " WHERE (`Extent1`.`State` > -1)" //
+ " AND ((`Extent1`.`Zone`) = (CASE WHEN (1 IS NULL) THEN (1) ELSE (1) END))";
Assert.assertTrue(provider.checkValid(sql));
}
}
@@ -0,0 +1,46 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.SQLServerWallProvider;
/**
* SQLServerWallTest
*
* @see
*/
public class SQLServerWallTest_11 extends TestCase {
public void test_true() throws Exception {
WallProvider provider = new SQLServerWallProvider();
provider.getConfig().setCommentAllow(true);
String sql = "SELECT KL_ArticleContent,KL_ArticleTitle " //
+ "FROM dbo.KL_Article " //
+ "WHERE KL_ArticleId =-4731 "//
+ "UNION ALL "//
+ "SELECT (SELECT TOP 1 CHAR(58)+CHAR(108)+CHAR(107)+CHAR(103)+CHAR(58)+ISNULL(CAST(name AS NVARCHAR(4000)),CHAR(32))+CHAR(58)+CHAR(109)+CHAR(122)+CHAR(104)+CHAR(58) FROM sys.sql_logins WHERE ISNULL(name,CHAR(32)) NOT IN (SELECT TOP 0 ISNULL(name,CHAR(32)) FROM sys.sql_logins ORDER BY 1) ORDER BY 1),NULL-- ";
Assert.assertFalse(provider.checkValid(sql));
}
}
@@ -0,0 +1,42 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.filter.wall;
import junit.framework.TestCase;
import org.junit.Assert;
import com.alibaba.druid.wall.WallProvider;
import com.alibaba.druid.wall.spi.SQLServerWallProvider;
/**
* SQLServerWallTest
*
* @see
*/
public class SQLServerWallTest_12 extends TestCase {
public void test_true() throws Exception {
WallProvider provider = new SQLServerWallProvider();
provider.getConfig().setCommentAllow(true);
String sql = "EXEC master..xp_msver";
Assert.assertTrue(provider.checkValid(sql));
}
}
@@ -0,0 +1,83 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.sql.mysql;
import java.util.List;
import org.junit.Assert;
import com.alibaba.druid.sql.MysqlTest;
import com.alibaba.druid.sql.SQLUtils;
import com.alibaba.druid.sql.ast.SQLExpr;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator;
import com.alibaba.druid.sql.ast.expr.SQLNotExpr;
import com.alibaba.druid.sql.ast.statement.SQLSelect;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlSchemaStatVisitor;
import com.alibaba.druid.stat.TableStat;
public class MySqlSelectTest_16 extends MysqlTest {
public void test_0() throws Exception {
String sql = "select a from t where not a>1 and not b<1";
MySqlStatementParser parser = new MySqlStatementParser(sql);
List<SQLStatement> statementList = parser.parseStatementList();
SQLStatement stmt = statementList.get(0);
SQLSelectStatement selectStmt = (SQLSelectStatement) stmt;
SQLSelect select = selectStmt.getSelect();
Assert.assertNotNull(select.getQuery());
MySqlSelectQueryBlock queryBlock = (MySqlSelectQueryBlock) select.getQuery();
Assert.assertNull(queryBlock.getOrderBy());
{
SQLExpr where = queryBlock.getWhere();
Assert.assertTrue(where instanceof SQLBinaryOpExpr);
SQLBinaryOpExpr binaryWhere = (SQLBinaryOpExpr) where;
Assert.assertEquals(binaryWhere.getOperator(), SQLBinaryOperator.BooleanAnd);
Assert.assertTrue(binaryWhere.getLeft() instanceof SQLNotExpr);
Assert.assertTrue(binaryWhere.getRight() instanceof SQLNotExpr);
}
print(statementList);
Assert.assertEquals(1, statementList.size());
MySqlSchemaStatVisitor visitor = new MySqlSchemaStatVisitor();
stmt.accept(visitor);
Assert.assertEquals(1, visitor.getTables().size());
Assert.assertEquals(2, visitor.getColumns().size());
Assert.assertEquals(2, visitor.getConditions().size());
Assert.assertEquals(0, visitor.getOrderByColumns().size());
Assert.assertTrue(visitor.getTables().containsKey(new TableStat.Name("t")));
String output = SQLUtils.toMySqlString(stmt);
Assert.assertEquals("SELECT a" //
+ "\nFROM t"//
+ "\nWHERE NOT a > 1"//
+ "\n\tAND NOT b < 1", //
output);
}
}
@@ -0,0 +1,64 @@
/*
* Copyright 1999-2011 Alibaba Group Holding Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.druid.bvt.sql.oracle;
import java.util.List;
import org.junit.Assert;
import com.alibaba.druid.sql.OracleTest;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser;
import com.alibaba.druid.sql.dialect.oracle.visitor.OracleSchemaStatVisitor;
import com.alibaba.druid.sql.test.TestUtils;
public class OracleSelectTest51 extends OracleTest {
public void test_0() throws Exception {
String sql = //
"select TRIM(TRAILING 'M' FROM RTRIM(' testM')) from dual;"; //
OracleStatementParser parser = new OracleStatementParser(sql);
List<SQLStatement> statementList = parser.parseStatementList();
SQLStatement stmt = statementList.get(0);
print(statementList);
Assert.assertEquals(1, statementList.size());
OracleSchemaStatVisitor visitor = new OracleSchemaStatVisitor();
stmt.accept(visitor);
System.out.println("Tables : " + visitor.getTables());
System.out.println("fields : " + visitor.getColumns());
System.out.println("coditions : " + visitor.getConditions());
System.out.println("relationships : " + visitor.getRelationships());
System.out.println("orderBy : " + visitor.getOrderByColumns());
Assert.assertEquals(0, visitor.getTables().size());
Assert.assertEquals(0, visitor.getColumns().size());
String text = TestUtils.outputOracle(stmt);
Assert.assertEquals("SELECT TRIM(TRAILING 'M' FROM RTRIM(' testM'))" //
+ "\nFROM dual;"//
+ "\n", text);
// Assert.assertTrue(visitor.getColumns().contains(new TableStat.Column("acduser.vw_acd_info", "xzqh")));
// Assert.assertTrue(visitor.getOrderByColumns().contains(new TableStat.Column("employees", "last_name")));
}
}