From 16a1e3a6ec47de5bace718249af6bf8573898f39 Mon Sep 17 00:00:00 2001 From: wenshao Date: Mon, 6 May 2013 14:23:55 +0800 Subject: [PATCH] improve wall filter --- .../com/alibaba/druid/wall/WallConfig.java | 2 +- .../druid/wall/spi/MySqlWallVisitor.java | 5 +- .../druid/wall/spi/WallVisitorUtils.java | 4 +- .../bvt/filter/wall/MySqlWallTest89.java | 46 ++++++++++++++++++ .../bvt/filter/wall/MySqlWallTest90.java | 48 +++++++++++++++++++ 5 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java create mode 100644 src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 8aa8883df9..b0d0bc3a3f 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -31,7 +31,7 @@ public class WallConfig implements WallConfigMBean { private boolean selectIntoAllow = true; private boolean selectIntoOutfileAllow = false; private boolean selectWhereAlwayTrueCheck = true; - private boolean selectHavingAlwayTrueCheck = true; + private boolean selectHavingAlwayTrueCheck = false; private boolean selectUnionCheck = true; private boolean createTableAllow = true; private boolean dropTableAllow = true; diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 68d1be852f..1aa506e897 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -63,6 +63,7 @@ import com.alibaba.druid.wall.WallContext; import com.alibaba.druid.wall.WallProvider; import com.alibaba.druid.wall.WallSqlTableStat; import com.alibaba.druid.wall.WallVisitor; +import com.alibaba.druid.wall.spi.WallVisitorUtils.WallConditionContext; import com.alibaba.druid.wall.violation.ErrorCode; import com.alibaba.druid.wall.violation.IllegalSQLObjectViolation; @@ -255,8 +256,8 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } if (varName.startsWith("@@") && !checkVar(x.getParent(), x.getName())) { - boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x); - if (!isTop) { + boolean noneCondition = WallVisitorUtils.getWallConditionContext() == null; + if (!noneCondition) { violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x))); } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index 3b2169d9c1..6ae42251d6 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -678,7 +678,9 @@ public class WallVisitorUtils { WallContext context = WallContext.current(); if (context != null) { if (current.hasPartAlwayTrue() || Boolean.TRUE == value) { - context.incrementWarnnings(); + if (!isFirst(x)) { + context.incrementWarnnings(); + } } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java new file mode 100644 index 0000000000..e0ce6035b6 --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest89.java @@ -0,0 +1,46 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest89 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + provider.getConfig().setSelectHavingAlwayTrueCheck(true); + + Assert.assertTrue(provider.checkValid(// + "select login('', '', 'guest', '47ea3937793101011caaa5dd88d3bcae926526624796b8a26a9615e8d3bea6b4', 'iPad3,4', 'unknown'), '', (select max(num) from accounts) + @@auto_increment_increment")); + + Assert.assertEquals(1, provider.getTableStats().size()); + Assert.assertTrue(provider.getTableStats().containsKey("accounts")); + } + +} diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java new file mode 100644 index 0000000000..81c802fccb --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest90.java @@ -0,0 +1,48 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.filter.wall; + +import junit.framework.TestCase; + +import org.junit.Assert; + +import com.alibaba.druid.wall.WallProvider; +import com.alibaba.druid.wall.spi.MySqlWallProvider; + +/** + * SQLServerWallTest + * + * @author RaymondXiu + * @version 1.0, 2012-3-18 + * @see + */ +public class MySqlWallTest90 extends TestCase { + + public void test_true() throws Exception { + WallProvider provider = new MySqlWallProvider(); + + provider.getConfig().setSelectHavingAlwayTrueCheck(true); + + Assert.assertTrue(provider.checkValid(// + "select * from (select t10006_men_xing_jia_ge_fen_lei.bian_hao as \"bian_hao\", " + // + " t10006_men_xing_jia_ge_fen_lei.ming_cheng as \"ming_cheng\" " + // + "from t10006_men_xing_jia_ge_fen_lei where 1=1 ) as tables where 1=1 order by tables.bian_hao")); + + Assert.assertEquals(1, provider.getTableStats().size()); + Assert.assertTrue(provider.getTableStats().containsKey("t10006_men_xing_jia_ge_fen_lei")); + } + +}