Merge branch 'master' of https://github.com/wenshao/druid

src/main/java/com/alibaba/druid/wall/WallConfig.java

@@ -31,7 +31,7 @@ public class WallConfig implements WallConfigMBean {
     private boolean             selectIntoAllow            = true;
     private boolean             selectIntoOutfileAllow     = false;
     private boolean             selectWhereAlwayTrueCheck  = true;
-    private boolean             selectHavingAlwayTrueCheck = true;
+    private boolean             selectHavingAlwayTrueCheck = false;
     private boolean             selectUnionCheck           = true;
     private boolean             createTableAllow           = true;
     private boolean             dropTableAllow             = true;

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -63,6 +63,7 @@ import com.alibaba.druid.wall.WallContext;
 import com.alibaba.druid.wall.WallProvider;
 import com.alibaba.druid.wall.WallSqlTableStat;
 import com.alibaba.druid.wall.WallVisitor;
+import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext;
 import com.alibaba.druid.wall.violation.ErrorCode;
 import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation;
 
@@ -255,8 +256,8 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         }
 
         if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) {
-            boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x);
-            if (!isTop) {
+            boolean noneCondition = WallVisitorUtils.getWallConditionContext() == null;
+            if (!noneCondition) {
                 violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : "
                                                                                      + x.getName(), toSQL(x)));
             }

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -678,7 +678,9 @@ public class WallVisitorUtils {
             WallContext context = WallContext.current();
             if (context != null) {
                 if (current.hasPartAlwayTrue() || Boolean.TRUE == value) {
-                    context.incrementWarnnings();
+                    if (!isFirst(x)) {
+                        context.incrementWarnnings();
+                    }
                 }
             }
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest89 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        
+        provider.getConfig().setSelectHavingAlwayTrueCheck(true);
+        
+        Assert.assertTrue(provider.checkValid(//
+        "select login('', '', 'guest', '47ea3937793101011caaa5dd88d3bcae926526624796b8a26a9615e8d3bea6b4', 'iPad3,4', 'unknown'),     '', (select max(num) from accounts) +  @@auto_increment_increment"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+        Assert.assertTrue(provider.getTableStats().containsKey("accounts"));
+    }
+
+}

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+
+/**
+ * SQLServerWallTest
+ * 
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class MySqlWallTest90 extends TestCase {
+
+    public void test_true() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+
+        provider.getConfig().setSelectHavingAlwayTrueCheck(true);
+
+        Assert.assertTrue(provider.checkValid(//
+        "select * from (select t10006_men_xing_jia_ge_fen_lei.bian_hao as \"bian_hao\", " + //
+                "   t10006_men_xing_jia_ge_fen_lei.ming_cheng as \"ming_cheng\" " + //
+                "from t10006_men_xing_jia_ge_fen_lei where 1=1 ) as tables where 1=1 order by tables.bian_hao"));
+
+        Assert.assertEquals(1, provider.getTableStats().size());
+        Assert.assertTrue(provider.getTableStats().containsKey("t10006_men_xing_jia_ge_fen_lei"));
+    }
+
+}