improve sqlwall: union

src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java

@@ -2147,6 +2147,14 @@ public class WallVisitorUtils {
             if (isTopUpdateStatement || isTopInsertStatement) {
                 return;
             }
+            
+            if (x.getLeft() instanceof SQLSelectQueryBlock) {
+                SQLSelectQueryBlock left = (SQLSelectQueryBlock) x.getLeft();
+                SQLTableSource tableSource = left.getFrom();
+                if (left.getWhere() == null && tableSource != null && tableSource instanceof SQLExprTableSource) {
+                    return;
+                }
+            }
 
             WallContext context = WallContext.current();
             if (context != null) {

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java

@@ -44,7 +44,7 @@ public class MySqlWallTest extends TestCase {
         Assert.assertFalse(WallUtils.isValidateMySql("select * FROM T WHERE id = 1 AND select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'"));
         Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'"));
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where c1=1 union select 1, 2"));
         
         Assert.assertTrue(WallUtils.isValidateMySql("select c1 from t where 1=1 or id =1"));
         Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 or 1=1"));

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java

@@ -55,11 +55,11 @@ public class MySqlWallTest62 extends TestCase {
         WallProvider provider = new MySqlWallProvider();
         provider.getConfig().setSchemaCheck(true);
         String sql = "SELECT 1, 2, 3" + //
-                     " UNION ALL SELECT  a  from tt " + //
+                     " UNION ALL SELECT  a  from tt where c=1" + //
                      " UNION ALL SELECT 2 FROM dual ";
         Assert.assertFalse(provider.checkValid(sql));
         
-        sql = "SELECT a from t UNION ALL SELECT 2 FROM dual ";
+        sql = "SELECT a from t where c=1 UNION ALL SELECT 2 FROM dual ";
         Assert.assertFalse(provider.checkValid(sql));
     }
 

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java

@@ -36,7 +36,7 @@ public class MySqlWallTest63 extends TestCase {
         provider.getConfig().setSchemaCheck(true);
 
         Assert.assertFalse(provider.checkValid(//
-        "SELECT FID, FNAME FROM T UNION SELECT 1, 'AAA'"));
+        "SELECT FID, FNAME FROM T WHERE C=1 UNION SELECT 1, 'AAA'"));
 
         Assert.assertEquals(1, provider.getTableStats().size());
     }

src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_union.java

@@ -28,11 +28,19 @@ public class MySqlWallTest_union extends TestCase {
         WallConfig config = new WallConfig();
         config.setSelectUnionCheck(true);
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2", config));
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select 1, 2", config));
 
-        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select null, '1', 2", config));
+        Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2", config));
 
-        Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t union select c1, c2", config));
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select null, '1', 2",
+                                                     config));
 
+        Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select c1, c2", config));
+
+        Assert.assertTrue(WallUtils.isValidateMySql("SELECT typeid, typename FROM (SELECT typeid, typename FROM materialtype UNION ALL SELECT ? AS typeid, ? AS typename) a ORDER BY typeid",
+                                                    config));
+
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from (select 1 as f1, 2 as f2) t union select 'u1', 'u2'",
+                                                     config));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java

@@ -24,7 +24,7 @@ import com.alibaba.druid.wall.WallUtils;
 public class OracleWallTest extends TestCase {
 
     public void testWall() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2"));
+        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2"));
         
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB"));
         Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)"));

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest.java

@@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils;
 public class WallUnionTest extends TestCase {
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where f1=1 union select 1, 2"));
     }
 
     public void testOracle() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2"));
+        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where f1=1 union select 1, 2"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java

@@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils;
 public class WallUnionTest2 extends TestCase {
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2 where 1 = 1"));
+        Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where f1 = 1 union select 1, 2 where 1 = 1"));
     }
 
     public void testOracle() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2 where 1 = 1"));
+        Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where f1 = 1 union select 1, 2 where 1 = 1"));
     }
 }

src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java

@@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils;
 public class WallUnionTest4 extends TestCase {
 
     public void testMySql() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)"));
+        Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM T1 t where id=1 UNION (SELECT * FROM (SELECT 1,'x') X)"));
     }
     
     public void testORACLE() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateOracle("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)"));
+        Assert.assertFalse(WallUtils.isValidateOracle("SELECT id, product FROM T1 t where id=1 UNION (SELECT * FROM (SELECT 1,'x') X)"));
     }
 }