diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java index b5f9cb496f..0183765934 100644 --- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java +++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java @@ -2147,6 +2147,14 @@ public class WallVisitorUtils { if (isTopUpdateStatement || isTopInsertStatement) { return; } + + if (x.getLeft() instanceof SQLSelectQueryBlock) { + SQLSelectQueryBlock left = (SQLSelectQueryBlock) x.getLeft(); + SQLTableSource tableSource = left.getFrom(); + if (left.getWhere() == null && tableSource != null && tableSource instanceof SQLExprTableSource) { + return; + } + } WallContext context = WallContext.current(); if (context != null) { diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java index e84ba46601..900cc71eea 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest.java @@ -44,7 +44,7 @@ public class MySqlWallTest extends TestCase { Assert.assertFalse(WallUtils.isValidateMySql("select * FROM T WHERE id = 1 AND select 0x3C3F706870206576616C28245F504F53545B2763275D293F3E into outfile '\\www\\edu\\1.php'")); Assert.assertTrue(WallUtils.isValidateMySql("select 'outfile'")); - Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2")); + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where c1=1 union select 1, 2")); Assert.assertTrue(WallUtils.isValidateMySql("select c1 from t where 1=1 or id =1")); Assert.assertFalse(WallUtils.isValidateMySql("select c1 from t where id =1 or 1=1")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java index 0c8035cce1..9db9859c6d 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest62.java @@ -55,11 +55,11 @@ public class MySqlWallTest62 extends TestCase { WallProvider provider = new MySqlWallProvider(); provider.getConfig().setSchemaCheck(true); String sql = "SELECT 1, 2, 3" + // - " UNION ALL SELECT a from tt " + // + " UNION ALL SELECT a from tt where c=1" + // " UNION ALL SELECT 2 FROM dual "; Assert.assertFalse(provider.checkValid(sql)); - sql = "SELECT a from t UNION ALL SELECT 2 FROM dual "; + sql = "SELECT a from t where c=1 UNION ALL SELECT 2 FROM dual "; Assert.assertFalse(provider.checkValid(sql)); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java index 0003163304..f6a7c44968 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest63.java @@ -36,7 +36,7 @@ public class MySqlWallTest63 extends TestCase { provider.getConfig().setSchemaCheck(true); Assert.assertFalse(provider.checkValid(// - "SELECT FID, FNAME FROM T UNION SELECT 1, 'AAA'")); + "SELECT FID, FNAME FROM T WHERE C=1 UNION SELECT 1, 'AAA'")); Assert.assertEquals(1, provider.getTableStats().size()); } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_union.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_union.java index 1ac15282fd..889e8e652b 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_union.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallTest_union.java @@ -28,11 +28,19 @@ public class MySqlWallTest_union extends TestCase { WallConfig config = new WallConfig(); config.setSelectUnionCheck(true); - Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2", config)); + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select 1, 2", config)); - Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select null, '1', 2", config)); + Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2", config)); - Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t union select c1, c2", config)); + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select null, '1', 2", + config)); + Assert.assertTrue(WallUtils.isValidateMySql("select f1, f2 from t where id=1 union select c1, c2", config)); + + Assert.assertTrue(WallUtils.isValidateMySql("SELECT typeid, typename FROM (SELECT typeid, typename FROM materialtype UNION ALL SELECT ? AS typeid, ? AS typename) a ORDER BY typeid", + config)); + + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from (select 1 as f1, 2 as f2) t union select 'u1', 'u2'", + config)); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java index 95ac54367a..ba9ffc8ac7 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/OracleWallTest.java @@ -24,7 +24,7 @@ import com.alibaba.druid.wall.WallUtils; public class OracleWallTest extends TestCase { public void testWall() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2")); + Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where c=1 union select 1, 2")); Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from TAB")); Assert.assertFalse(WallUtils.isValidateOracle("SELECT * FROM T UNION select * from ALL_TABLES where (1=1 or (1+1)=2) and (4=8 or 1=1)")); diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest.java index 06090dd4d8..ada8f2ed2b 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest.java @@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils; public class WallUnionTest extends TestCase { public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2")); + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where f1=1 union select 1, 2")); } public void testOracle() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2")); + Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where f1=1 union select 1, 2")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java index 21fe74aed2..729e4b3253 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest2.java @@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils; public class WallUnionTest2 extends TestCase { public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t union select 1, 2 where 1 = 1")); + Assert.assertFalse(WallUtils.isValidateMySql("select f1, f2 from t where f1 = 1 union select 1, 2 where 1 = 1")); } public void testOracle() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t union select 1, 2 where 1 = 1")); + Assert.assertFalse(WallUtils.isValidateOracle("select f1, f2 from t where f1 = 1 union select 1, 2 where 1 = 1")); } } diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java index 7d23350746..9477af4ba8 100644 --- a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java +++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallUnionTest4.java @@ -29,10 +29,10 @@ import com.alibaba.druid.wall.WallUtils; public class WallUnionTest4 extends TestCase { public void testMySql() throws Exception { - Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)")); + Assert.assertFalse(WallUtils.isValidateMySql("SELECT id, product FROM T1 t where id=1 UNION (SELECT * FROM (SELECT 1,'x') X)")); } public void testORACLE() throws Exception { - Assert.assertFalse(WallUtils.isValidateOracle("SELECT id, product FROM T1 t UNION (SELECT * FROM (SELECT 1,'x') X)")); + Assert.assertFalse(WallUtils.isValidateOracle("SELECT id, product FROM T1 t where id=1 UNION (SELECT * FROM (SELECT 1,'x') X)")); } }