Alawn/Druid
1
0
Fork 0
mirror of https://github.com/alibaba/druid.git synced 2023-03-04 19:17:16 +00:00
Code Issues Releases Wiki Activity

improve WallFilter

Browse Source
This commit is contained in:
wenshao
2012-12-18 21:41:34 +08:00
parent 5191b74cba
commit fb4bea6f90
7 changed files with 132 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/druid/sql/parser/SQLParser.java
+4
View File
@@ -83,6 +83,10 @@ public class SQLParser {
default:
break;
}
if (lexer.token() == Token.LPAREN) {
return null;
}
throw new ParserException("Error : " + lexer.token());
}
src/main/java/com/alibaba/druid/wall/WallConfig.java
+10
View File
@@ -34,6 +34,8 @@ public class WallConfig implements WallConfigMBean {
private boolean selectHavingAlwayTrueCheck = true;
private boolean selectUnionCheck = true;
private boolean selectAllColumnAllow = true;
private boolean deleteAllow = true;
private boolean deleteWhereAlwayTrueCheck = true;
@@ -112,6 +114,14 @@ public class WallConfig implements WallConfigMBean {
this.allowDoPrivileged = allowDoPrivileged;
}
public boolean isSelectAllColumnAllow() {
return selectAllColumnAllow;
}
public void setSelectAllColumnAllow(boolean selectAllColumnAllow) {
this.selectAllColumnAllow = selectAllColumnAllow;
}
public boolean isInited() {
return inited;
}
src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+8 -2
View File
@@ -33,6 +33,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
@@ -71,7 +72,7 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
public WallConfig getConfig() {
return config;
}
public void addViolation(Violation violation) {
this.violations.add(violation);
}
@@ -259,10 +260,15 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
} else if (x instanceof SQLTruncateStatement) {
allow = config.isTruncateAllow();
}
if (!allow) {
violations.add(new IllegalSQLObjectViolation(toSQL(x)));
}
}
@Override
public boolean visit(SQLSelectItem x) {
WallVisitorUtils.check(this, x);
return true;
}
}
src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
+7
View File
@@ -32,6 +32,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
@@ -263,4 +264,10 @@ public class OracleWallVisitor extends OracleASTVisitorAdapter implements WallVi
return true;
}
@Override
public boolean visit(SQLSelectItem x) {
WallVisitorUtils.check(this, x);
return true;
}
}
src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+15
View File
@@ -33,11 +33,13 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock;
import com.alibaba.druid.sql.dialect.sqlserver.ast.expr.SQLServerObjectReferenceExpr;
import com.alibaba.druid.sql.dialect.sqlserver.ast.stmt.SQLServerInsertStatement;
import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor;
@@ -137,6 +139,13 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
WallVisitorUtils.checkHaving(this, x.getHaving());
return true;
}
@Override
public boolean visit(SQLServerSelectQueryBlock x) {
WallVisitorUtils.checkSelelct(this, x);
return true;
}
@Override
public boolean visit(SQLSelectQueryBlock x) {
@@ -248,4 +257,10 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
public void endVisit(SQLServerInsertStatement x) {
this.endVisit((SQLInsertStatement) x);
}
@Override
public boolean visit(SQLSelectItem x) {
WallVisitorUtils.check(this, x);
return true;
}
}
src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+30 -10
View File
@@ -79,6 +79,22 @@ public class WallVisitorUtils {
}
public static void check(WallVisitor visitor, SQLSelectItem x) {
if (visitor.getConfig().isSelectAllColumnAllow()) {
return;
}
if (x.getExpr() instanceof SQLAllColumnExpr //
&& x.getParent() instanceof SQLSelectQueryBlock) {
SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) x.getParent();
SQLTableSource from = queryBlock.getFrom();
if (from instanceof SQLExprTableSource) {
addViolation(visitor, x);
}
}
}
public static void check(WallVisitor visitor, SQLPropertyExpr x) {
checkSchema(visitor, x.getOwner());
}
@@ -92,6 +108,10 @@ public class WallVisitorUtils {
}
public static void checkSelelct(WallVisitor visitor, SQLSelectQueryBlock x) {
for (SQLSelectItem item : x.getSelectList()) {
item.setParent(x);
}
if (x.getInto() != null) {
checkReadOnly(visitor, x.getInto());
}
@@ -228,8 +248,8 @@ public class WallVisitorUtils {
alias = join.getLeft().getAlias();
}
}
checkJoinConditionForMultiTenant(visitor, join, false);
checkJoinConditionForMultiTenant(visitor, join, false);
} else {
checkJoinConditionForMultiTenant(visitor, join, true);
}
@@ -262,14 +282,14 @@ public class WallVisitorUtils {
if (tenantTablePattern == null || tenantTablePattern.length() == 0) {
return;
}
SQLExpr condition = join.getCondition();
if (checkLeft) {
}
SQLTableSource right = join.getRight();
SQLTableSource right = join.getRight();
if (right instanceof SQLExprTableSource) {
SQLExpr tableExpr = ((SQLExprTableSource) right).getExpr();
@@ -281,7 +301,7 @@ public class WallVisitorUtils {
alias = tableName;
}
SQLBinaryOpExpr tenantCondition = cretateTenantCondition(visitor, alias);
if (condition == null) {
condition = tenantCondition;
} else {
@@ -290,12 +310,12 @@ public class WallVisitorUtils {
}
}
}
if (condition != join.getCondition()) {
join.setCondition(condition);
}
}
private static SQLBinaryOpExpr cretateTenantCondition(WallVisitor visitor, String alias) {
SQLExpr left, right;
if (alias != null) {