From fb4bea6f905ae6726baa8e8e4eba85145a5e3430 Mon Sep 17 00:00:00 2001 From: wenshao Date: Tue, 18 Dec 2012 21:41:34 +0800 Subject: [PATCH] improve WallFilter --- .../alibaba/druid/sql/parser/SQLParser.java | 4 ++ .../com/alibaba/druid/wall/WallConfig.java | 10 ++++ .../druid/wall/spi/MySqlWallVisitor.java | 10 +++- .../druid/wall/spi/OracleWallVisitor.java | 7 +++ .../druid/wall/spi/SQLServerWallVisitor.java | 15 +++++ .../druid/wall/spi/WallVisitorUtils.java | 40 +++++++++---- .../bvt/sql/postgresql/PGSelectTest6.java | 58 +++++++++++++++++++ 7 files changed, 132 insertions(+), 12 deletions(-) create mode 100644 src/test/java/com/alibaba/druid/bvt/sql/postgresql/PGSelectTest6.java diff --git a/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java b/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java index 0f4ea9da03..b63c5544c3 100644 --- a/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java +++ b/src/main/java/com/alibaba/druid/sql/parser/SQLParser.java @@ -83,6 +83,10 @@ public class SQLParser { default: break; } + + if (lexer.token() == Token.LPAREN) { + return null; + } throw new ParserException("Error : " + lexer.token()); } diff --git a/src/main/java/com/alibaba/druid/wall/WallConfig.java b/src/main/java/com/alibaba/druid/wall/WallConfig.java index 47cbf44207..1b8f901b28 100644 --- a/src/main/java/com/alibaba/druid/wall/WallConfig.java +++ b/src/main/java/com/alibaba/druid/wall/WallConfig.java @@ -34,6 +34,8 @@ public class WallConfig implements WallConfigMBean { private boolean selectHavingAlwayTrueCheck = true; private boolean selectUnionCheck = true; + private boolean selectAllColumnAllow = true; + private boolean deleteAllow = true; private boolean deleteWhereAlwayTrueCheck = true; @@ -112,6 +114,14 @@ public class WallConfig implements WallConfigMBean { this.allowDoPrivileged = allowDoPrivileged; } + public boolean isSelectAllColumnAllow() { + return selectAllColumnAllow; + } + + public void setSelectAllColumnAllow(boolean selectAllColumnAllow) { + this.selectAllColumnAllow = selectAllColumnAllow; + } + public boolean isInited() { return inited; } diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java index 9d691b2dce..abcde60695 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java @@ -33,6 +33,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; +import com.alibaba.druid.sql.ast.statement.SQLSelectItem; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; @@ -71,7 +72,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi public WallConfig getConfig() { return config; } - + public void addViolation(Violation violation) { this.violations.add(violation); } @@ -259,10 +260,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi } else if (x instanceof SQLTruncateStatement) { allow = config.isTruncateAllow(); } - + if (!allow) { violations.add(new IllegalSQLObjectViolation(toSQL(x))); } } + @Override + public boolean visit(SQLSelectItem x) { + WallVisitorUtils.check(this, x); + return true; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java index 8752c45a3d..86de9d461d 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java @@ -32,6 +32,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; +import com.alibaba.druid.sql.ast.statement.SQLSelectItem; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; @@ -263,4 +264,10 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi return true; } + + @Override + public boolean visit(SQLSelectItem x) { + WallVisitorUtils.check(this, x); + return true; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java index 90e35f73b4..09fa50ee08 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java +++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java @@ -33,11 +33,13 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement; import com.alibaba.druid.sql.ast.statement.SQLExprTableSource; import com.alibaba.druid.sql.ast.statement.SQLInsertStatement; import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause; +import com.alibaba.druid.sql.ast.statement.SQLSelectItem; import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock; import com.alibaba.druid.sql.ast.statement.SQLSelectStatement; import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement; import com.alibaba.druid.sql.ast.statement.SQLUnionQuery; import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement; +import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock; import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr; import com.alibaba.druid.sql.dialect.sqlserver.ast.stmt.SQLServerInsertStatement; import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor; @@ -137,6 +139,13 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements WallVisitorUtils.checkHaving(this, x.getHaving()); return true; } + + @Override + public boolean visit(SQLServerSelectQueryBlock x) { + WallVisitorUtils.checkSelelct(this, x); + + return true; + } @Override public boolean visit(SQLSelectQueryBlock x) { @@ -248,4 +257,10 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements public void endVisit(SQLServerInsertStatement x) { this.endVisit((SQLInsertStatement) x); } + + @Override + public boolean visit(SQLSelectItem x) { + WallVisitorUtils.check(this, x); + return true; + } } diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index f8ebcb76ce..830baf67a6 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -79,6 +79,22 @@ public class WallVisitorUtils { } + public static void check(WallVisitor visitor, SQLSelectItem x) { + if (visitor.getConfig().isSelectAllColumnAllow()) { + return; + } + + if (x.getExpr() instanceof SQLAllColumnExpr // + && x.getParent() instanceof SQLSelectQueryBlock) { + SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent(); + SQLTableSource from = queryBlock.getFrom(); + + if (from instanceof SQLExprTableSource) { + addViolation(visitor, x); + } + } + } + public static void check(WallVisitor visitor, SQLPropertyExpr x) { checkSchema(visitor, x.getOwner()); } @@ -92,6 +108,10 @@ public class WallVisitorUtils { } public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) { + for (SQLSelectItem item : x.getSelectList()) { + item.setParent(x); + } + if (x.getInto() != null) { checkReadOnly(visitor, x.getInto()); } @@ -228,8 +248,8 @@ public class WallVisitorUtils { alias = join.getLeft().getAlias(); } } - - checkJoinConditionForMultiTenant(visitor, join, false); + + checkJoinConditionForMultiTenant(visitor, join, false); } else { checkJoinConditionForMultiTenant(visitor, join, true); } @@ -262,14 +282,14 @@ public class WallVisitorUtils { if (tenantTablePattern == null || tenantTablePattern.length() == 0) { return; } - + SQLExpr condition = join.getCondition(); - + if (checkLeft) { - + } - - SQLTableSource right = join.getRight(); + + SQLTableSource right = join.getRight(); if (right instanceof SQLExprTableSource) { SQLExpr tableExpr = ((SQLExprTableSource) right).getExpr(); @@ -281,7 +301,7 @@ public class WallVisitorUtils { alias = tableName; } SQLBinaryOpExpr tenantCondition = cretateTenantCondition(visitor, alias); - + if (condition == null) { condition = tenantCondition; } else { @@ -290,12 +310,12 @@ public class WallVisitorUtils { } } } - + if (condition != join.getCondition()) { join.setCondition(condition); } } - + private static SQLBinaryOpExpr cretateTenantCondition(WallVisitor visitor, String alias) { SQLExpr left, right; if (alias != null) { diff --git a/src/test/java/com/alibaba/druid/bvt/sql/postgresql/PGSelectTest6.java b/src/test/java/com/alibaba/druid/bvt/sql/postgresql/PGSelectTest6.java new file mode 100644 index 0000000000..81a96dc31e --- /dev/null +++ b/src/test/java/com/alibaba/druid/bvt/sql/postgresql/PGSelectTest6.java @@ -0,0 +1,58 @@ +/* + * Copyright 1999-2011 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.druid.bvt.sql.postgresql; + +import java.util.List; + +import junit.framework.Assert; + +import com.alibaba.druid.sql.PGTest; +import com.alibaba.druid.sql.ast.SQLStatement; +import com.alibaba.druid.sql.dialect.postgresql.parser.PGSQLStatementParser; +import com.alibaba.druid.sql.dialect.postgresql.visitor.PGSchemaStatVisitor; + +public class PGSelectTest6 extends PGTest { + + public void test_0() throws Exception { + String sql = "select fromUserId, toMemberId, rank, tag " + // + "from cnres.function_get_re_cni_myali_acion_fct0(?) " + // + "as (fromUserId character varying(128), toMemberId character varying(128), rank numeric, tag character varying(128))"; + + PGSQLStatementParser parser = new PGSQLStatementParser(sql); + List statementList = parser.parseStatementList(); + SQLStatement statemen = statementList.get(0); + print(statementList); + + Assert.assertEquals(1, statementList.size()); + + PGSchemaStatVisitor visitor = new PGSchemaStatVisitor(); + statemen.accept(visitor); + + System.out.println("Tables : " + visitor.getTables()); + System.out.println("fields : " + visitor.getColumns()); + System.out.println("coditions : " + visitor.getConditions()); + + Assert.assertEquals(4, visitor.getColumns().size()); + Assert.assertEquals(0, visitor.getTables().size()); + } + +} + +// select categoryId , offerIds from cnres.function_select_get_spt_p4p_offer_list (' 1031918 , 1031919 , 1037004 ') as +// a(categoryId numeric,offerIds character varying(4000)) +// select memberId , offerIds from cnres.function_select_get_seller_hot_offer_list('\'gzyyd168\'') as a(memberId +// character varying(20),offerIds character varying(4000)) +