From f748b4edf5c1e06fd085b4cc4b587ce3c539a71f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=B8=A9=E5=B0=91?= Date: Fri, 16 Mar 2012 16:12:25 +0800 Subject: [PATCH] wall filter --- .../filter/wall/spi/MySqlWallVisitor.java | 36 ++++++++++++++++++- .../filter/wall/spi/OracleWallVisitor.java | 26 ++++++++++++++ .../filter/wall/spi/WallVisitorUtils.java | 2 +- .../bvt/filter/wall/MySqlWallLimitTest.java | 21 +++++++++++ .../bvt/filter/wall/WallDeleteWhereTest.java | 24 +++++++++++++ .../bvt/filter/wall/WallSelectWhereTest.java | 24 +++++++++++++ .../bvt/filter/wall/WallSelectWhereTest1.java | 24 +++++++++++++ .../bvt/filter/wall/WallSelectWhereTest2.java | 24 +++++++++++++ .../bvt/filter/wall/WallUpdateWhereTest.java | 24 +++++++++++++ 9 files changed, 203 insertions(+), 2 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallLimitTest.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java index 3e5a7481c5..03fa1a2a47 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/MySqlWallVisitor.java @@ -14,6 +14,7 @@ import com.alibaba.druid.sql.ast.SQLObject; import com.alibaba.druid.sql.ast.SQLStatement; import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr; import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr; +import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr; import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr; import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr; import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; @@ -25,8 +26,10 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; import com.alibaba.druid.sql.dialect.mysql.ast.expr.MySqlOutFileExpr; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlDeleteStatement; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectGroupBy; import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock; +import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit; import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitor; import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter; @@ -121,7 +124,38 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi @Override public boolean visit(MySqlSelectQueryBlock x) { - return visit((SQLSelectQueryBlock) x); + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(MySqlDeleteStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + + @Override + public boolean visit(SQLDeleteStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(SQLUpdateStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(Limit x) { + if (x.getRowCount() instanceof SQLNumericLiteralExpr) { + int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue(); + if (rowCount == 0) { + this.getViolations().add(new IllegalSQLObjectViolation(this.toSQL(x))); + } + } + return true; } public boolean visit(SQLVariantRefExpr x) { diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java index c043cc8960..fb5781297f 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/OracleWallVisitor.java @@ -25,10 +25,12 @@ import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; +import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMergeStatement; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleMultiInsertStatement; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectQueryBlock; import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectTableReference; +import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleUpdateStatement; import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVIsitorAdapter; public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVisitor { @@ -167,6 +169,30 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi return true; } + @Override + public boolean visit(OracleDeleteStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(SQLDeleteStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(SQLUpdateStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + + @Override + public boolean visit(OracleUpdateStatement x) { + WallVisitorUtils.checkCondition(this, x.getWhere()); + return true; + } + @Override public String toSQL(SQLObject obj) { return SQLUtils.toOracleString(obj); diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java index 3208ea7285..985e18b7aa 100644 --- a/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/filter/wall/spi/WallVisitorUtils.java @@ -47,7 +47,7 @@ public class WallVisitorUtils { String owner = x.getOwner().toString(); owner = WallVisitorUtils.form(owner); if (visitor.containsPermitObjects(owner)) { - visitor.getViolations().add(new IllegalSQLObjectViolation(SQLUtils.toOracleString(x))); + visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x))); } } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallLimitTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallLimitTest.java new file mode 100644 index 0000000000..f6d9a80650 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallLimitTest.java @@ -0,0 +1,21 @@ +package com.alibaba.druid.bvt.filter.wall; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +import junit.framework.TestCase; + +/** + * 这个场景测试访问MySql系统函数 + * + * @author admin + */ +public class MySqlWallLimitTest extends TestCase { + + public void test_permitTable() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM T LIMIT 0")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT * FROM T LIMIT 10, 0")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java new file mode 100644 index 0000000000..93d8973b12 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallDeleteWhereTest.java @@ -0,0 +1,24 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测可疑的Having条件 + * @author wenshao + * + */ +public class WallDeleteWhereTest extends TestCase { + private String sql = "DELETE FROM T WHERE 1 = 1"; + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(sql)); + } + + public void testORACLE() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle(sql)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java new file mode 100644 index 0000000000..dabacf1248 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest.java @@ -0,0 +1,24 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测可疑的Having条件 + * @author wenshao + * + */ +public class WallSelectWhereTest extends TestCase { + private String sql = "SELECT F1, F2 WHERE 1 = 1"; + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(sql)); + } + + public void testORACLE() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle(sql)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java new file mode 100644 index 0000000000..af8bc2c516 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest1.java @@ -0,0 +1,24 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测可疑的Having条件 + * @author wenshao + * + */ +public class WallSelectWhereTest1 extends TestCase { + private String sql = "SELECT F1, F2 WHERE 1 = 1 OR FID = ?"; + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(sql)); + } + + public void testORACLE() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle(sql)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java new file mode 100644 index 0000000000..fa91d2e3f7 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallSelectWhereTest2.java @@ -0,0 +1,24 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测可疑的Having条件 + * @author wenshao + * + */ +public class WallSelectWhereTest2 extends TestCase { + private String sql = "SELECT F1, F2 WHERE 1 = 1 AND FID = ?"; + + public void testMySql() throws Exception { + Assert.assertTrue(WallUtils.isValidateMySql(sql)); + } + + public void testORACLE() throws Exception { + Assert.assertTrue(WallUtils.isValidateOracle(sql)); + } +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java new file mode 100644 index 0000000000..1718b2ee4c --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUpdateWhereTest.java @@ -0,0 +1,24 @@ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.filter.wall.WallUtils; + +/** + * 这个场景，检测可疑的Having条件 + * @author wenshao + * + */ +public class WallUpdateWhereTest extends TestCase { + private String sql = "UPDATE T SET F1 = 0 WHERE 1 = 1"; + + public void testMySql() throws Exception { + Assert.assertFalse(WallUtils.isValidateMySql(sql)); + } + + public void testORACLE() throws Exception { + Assert.assertFalse(WallUtils.isValidateOracle(sql)); + } +}