wall filter

src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java

@@ -14,6 +14,7 @@ import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
+import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
 import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr;
 import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
@@ -25,8 +26,10 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
 import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
 import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr;
+import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDeleteStatement;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
+import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter;
 
@@ -121,7 +124,38 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
 
     @Override
     public boolean visit(MySqlSelectQueryBlock x) {
-        return visit((SQLSelectQueryBlock) x);
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    @Override
+    public boolean visit(MySqlDeleteStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    
+    @Override
+    public boolean visit(SQLDeleteStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    @Override
+    public boolean visit(SQLUpdateStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    @Override
+    public boolean visit(Limit x) {
+        if (x.getRowCount() instanceof SQLNumericLiteralExpr) {
+            int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue();
+            if (rowCount == 0) {
+                this.getViolations().add(new IllegalSQLObjectViolation(this.toSQL(x)));
+            }
+        }
+        return true;
     }
 
     public boolean visit(SQLVariantRefExpr x) {

src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java

@@ -25,10 +25,12 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
 import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMergeStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMultiInsertStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectTableReference;
+import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleUpdateStatement;
 import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVIsitorAdapter;
 
 public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVisitor {
@@ -167,6 +169,30 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
         return true;
     }
 
+    @Override
+    public boolean visit(OracleDeleteStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLDeleteStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    @Override
+    public boolean visit(SQLUpdateStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+    
+    @Override
+    public boolean visit(OracleUpdateStatement x) {
+        WallVisitorUtils.checkCondition(this, x.getWhere());
+        return true;
+    }
+
     @Override
     public String toSQL(SQLObject obj) {
         return SQLUtils.toOracleString(obj);

src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java

@@ -47,7 +47,7 @@ public class WallVisitorUtils {
             String owner = x.getOwner().toString();
             owner = WallVisitorUtils.form(owner);
             if (visitor.containsPermitObjects(owner)) {
-                visitor.getViolations().add(new IllegalSQLObjectViolation(SQLUtils.toOracleString(x)));
+                visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
             }
         }
     }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallLimitTest.java

@@ -0,0 +1,21 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+import junit.framework.TestCase;
+
+/**
+ * 这个场景测试访问MySql系统函数
+ * 
+ * @author admin
+ */
+public class MySqlWallLimitTest extends TestCase {
+
+    public void test_permitTable() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM T LIMIT 0"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM T LIMIT 10, 0"));
+    }
+    
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallDeleteWhereTest extends TestCase {
+    private String sql = "DELETE FROM T WHERE 1 = 1";
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallSelectWhereTest extends TestCase {
+    private String sql = "SELECT F1, F2 WHERE 1 = 1";
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallSelectWhereTest1 extends TestCase {
+    private String sql = "SELECT F1, F2 WHERE 1 = 1 OR FID = ?";
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallSelectWhereTest2 extends TestCase {
+    private String sql = "SELECT F1, F2 WHERE 1 = 1 AND FID = ?";
+
+    public void testMySql() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertTrue(WallUtils.isValidateOracle(sql));
+    }
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java

@@ -0,0 +1,24 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景，检测可疑的Having条件
+ * @author wenshao
+ *
+ */
+public class WallUpdateWhereTest extends TestCase {
+    private String sql = "UPDATE T SET F1 = 0 WHERE 1 = 1";
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql));
+    }
+    
+    public void testORACLE() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateOracle(sql));
+    }
+}