improve WallFilter

src/main/java/com/alibaba/druid/sql/parser/SQLParser.java

@@ -83,6 +83,10 @@ public class SQLParser {
                 default:
                     break;
             }
+            
+            if (lexer.token() == Token.LPAREN) {
+                return null;
+            }
 
             throw new ParserException("Error : " + lexer.token());
         }

src/main/java/com/alibaba/druid/wall/WallConfig.java

@@ -34,6 +34,8 @@ public class WallConfig implements WallConfigMBean {
     private boolean             selectHavingAlwayTrueCheck = true;
     private boolean             selectUnionCheck           = true;
 
+    private boolean             selectAllColumnAllow       = true;
+
     private boolean             deleteAllow                = true;
     private boolean             deleteWhereAlwayTrueCheck  = true;
 
@@ -112,6 +114,14 @@ public class WallConfig implements WallConfigMBean {
         this.allowDoPrivileged = allowDoPrivileged;
     }
 
+    public boolean isSelectAllColumnAllow() {
+        return selectAllColumnAllow;
+    }
+
+    public void setSelectAllColumnAllow(boolean selectAllColumnAllow) {
+        this.selectAllColumnAllow = selectAllColumnAllow;
+    }
+
     public boolean isInited() {
         return inited;
     }

src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java

@@ -33,6 +33,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
+import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
 import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
@@ -71,7 +72,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
     public WallConfig getConfig() {
         return config;
     }
-    
+
     public void addViolation(Violation violation) {
         this.violations.add(violation);
     }
@@ -259,10 +260,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         } else if (x instanceof SQLTruncateStatement) {
             allow = config.isTruncateAllow();
         }
-        
+
         if (!allow) {
             violations.add(new IllegalSQLObjectViolation(toSQL(x)));
         }
     }
 
+    @Override
+    public boolean visit(SQLSelectItem x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 }

src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java

@@ -32,6 +32,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
+import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
 import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
@@ -263,4 +264,10 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
 
         return true;
     }
+    
+    @Override
+    public boolean visit(SQLSelectItem x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 }

src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java

@@ -33,11 +33,13 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
+import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
 import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
 import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr;
 import com.alibaba.druid.sql.dialect.sqlserver.ast.stmt.SQLServerInsertStatement;
 import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor;
@@ -137,6 +139,13 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         WallVisitorUtils.checkHaving(this, x.getHaving());
         return true;
     }
+    
+    @Override
+    public boolean visit(SQLServerSelectQueryBlock x) {
+        WallVisitorUtils.checkSelelct(this, x);
+
+        return true;
+    }
 
     @Override
     public boolean visit(SQLSelectQueryBlock x) {
@@ -248,4 +257,10 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
     public void endVisit(SQLServerInsertStatement x) {
         this.endVisit((SQLInsertStatement) x);        
     }
+    
+    @Override
+    public boolean visit(SQLSelectItem x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 }

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -79,6 +79,22 @@ public class WallVisitorUtils {
 
     }
 
+    public static void check(WallVisitor visitor, SQLSelectItem x) {
+        if (visitor.getConfig().isSelectAllColumnAllow()) {
+            return;
+        }
+
+        if (x.getExpr() instanceof SQLAllColumnExpr //
+            && x.getParent() instanceof SQLSelectQueryBlock) {
+            SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent();
+            SQLTableSource from = queryBlock.getFrom();
+            
+            if (from instanceof SQLExprTableSource) {
+                addViolation(visitor, x);
+            }
+        }
+    }
+
     public static void check(WallVisitor visitor, SQLPropertyExpr x) {
         checkSchema(visitor, x.getOwner());
     }
@@ -92,6 +108,10 @@ public class WallVisitorUtils {
     }
 
     public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) {
+        for (SQLSelectItem item : x.getSelectList()) {
+            item.setParent(x);
+        }
+
         if (x.getInto() != null) {
             checkReadOnly(visitor, x.getInto());
         }
@@ -228,8 +248,8 @@ public class WallVisitorUtils {
                         alias = join.getLeft().getAlias();
                     }
                 }
-                
-                checkJoinConditionForMultiTenant(visitor, join, false);    
+
+                checkJoinConditionForMultiTenant(visitor, join, false);
             } else {
                 checkJoinConditionForMultiTenant(visitor, join, true);
             }
@@ -262,14 +282,14 @@ public class WallVisitorUtils {
         if (tenantTablePattern == null || tenantTablePattern.length() == 0) {
             return;
         }
-        
+
         SQLExpr condition = join.getCondition();
-        
+
         if (checkLeft) {
-            
+
         }
-        
-        SQLTableSource  right = join.getRight();
+
+        SQLTableSource right = join.getRight();
         if (right instanceof SQLExprTableSource) {
             SQLExpr tableExpr = ((SQLExprTableSource) right).getExpr();
 
@@ -281,7 +301,7 @@ public class WallVisitorUtils {
                         alias = tableName;
                     }
                     SQLBinaryOpExpr tenantCondition = cretateTenantCondition(visitor, alias);
-                    
+
                     if (condition == null) {
                         condition = tenantCondition;
                     } else {
@@ -290,12 +310,12 @@ public class WallVisitorUtils {
                 }
             }
         }
-        
+
         if (condition != join.getCondition()) {
             join.setCondition(condition);
         }
     }
-    
+
     private static SQLBinaryOpExpr cretateTenantCondition(WallVisitor visitor, String alias) {
         SQLExpr left, right;
         if (alias != null) {

src/test/java/com/alibaba/druid/bvt/sql/postgresql/PGSelectTest6.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 1999-2011 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.alibaba.druid.bvt.sql.postgresql;
+
+import java.util.List;
+
+import junit.framework.Assert;
+
+import com.alibaba.druid.sql.PGTest;
+import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.dialect.postgresql.parser.PGSQLStatementParser;
+import com.alibaba.druid.sql.dialect.postgresql.visitor.PGSchemaStatVisitor;
+
+public class PGSelectTest6 extends PGTest {
+
+    public void test_0() throws Exception {
+        String sql = "select fromUserId, toMemberId, rank, tag " + //
+                     "from cnres.function_get_re_cni_myali_acion_fct0(?) " + //
+                     "as (fromUserId character varying(128), toMemberId character varying(128), rank numeric, tag character varying(128))";
+
+        PGSQLStatementParser parser = new PGSQLStatementParser(sql);
+        List<SQLStatement> statementList = parser.parseStatementList();
+        SQLStatement statemen = statementList.get(0);
+        print(statementList);
+
+        Assert.assertEquals(1, statementList.size());
+
+        PGSchemaStatVisitor visitor = new PGSchemaStatVisitor();
+        statemen.accept(visitor);
+
+        System.out.println("Tables : " + visitor.getTables());
+        System.out.println("fields : " + visitor.getColumns());
+        System.out.println("coditions : " + visitor.getConditions());
+
+        Assert.assertEquals(4, visitor.getColumns().size());
+        Assert.assertEquals(0, visitor.getTables().size());
+    }
+
+}
+
+// select categoryId , offerIds from cnres.function_select_get_spt_p4p_offer_list (' 1031918 , 1031919 , 1037004 ') as
+// a(categoryId numeric,offerIds character varying(4000))
+// select memberId , offerIds from cnres.function_select_get_seller_hot_offer_list('\'gzyyd168\'') as a(memberId
+// character varying(20),offerIds character varying(4000))
+