Examples with SQLDeleteStatement com.alibaba.druid.sql.ast.statement.SQLDeleteStatement used on opensource projects

Example 1 with SQLDeleteStatement

use of com.alibaba.druid.sql.ast.statement.SQLDeleteStatement in project Mycat-Server by MyCATApache.

the class MycatPrivileges method checkDmlPrivilege.

// 审计SQL权限
@Override
public boolean checkDmlPrivilege(String user, String schema, String sql) {
    if (schema == null) {
        return true;
    }
    boolean isPassed = false;
    MycatConfig conf = MycatServer.getInstance().getConfig();
    UserConfig userConfig = conf.getUsers().get(user);
    if (userConfig != null) {
        UserPrivilegesConfig userPrivilege = userConfig.getPrivilegesConfig();
        if (userPrivilege != null && userPrivilege.isCheck()) {
            UserPrivilegesConfig.SchemaPrivilege schemaPrivilege = userPrivilege.getSchemaPrivilege(schema);
            if (schemaPrivilege != null) {
                String tableName = null;
                int index = -1;
                //TODO 此处待优化，寻找更优SQL 解析器
                SQLStatementParser parser = new MycatStatementParser(sql);
                SQLStatement stmt = parser.parseStatement();
                if (stmt instanceof MySqlReplaceStatement || stmt instanceof SQLInsertStatement) {
                    index = 0;
                } else if (stmt instanceof SQLUpdateStatement) {
                    index = 1;
                } else if (stmt instanceof SQLSelectStatement) {
                    index = 2;
                } else if (stmt instanceof SQLDeleteStatement) {
                    index = 3;
                }
                if (index > -1) {
                    SchemaStatVisitor schemaStatVisitor = new MycatSchemaStatVisitor();
                    stmt.accept(schemaStatVisitor);
                    String key = schemaStatVisitor.getCurrentTable();
                    if (key != null) {
                        if (key.contains("`")) {
                            key = key.replaceAll("`", "");
                        }
                        int dotIndex = key.indexOf(".");
                        if (dotIndex > 0) {
                            tableName = key.substring(dotIndex + 1);
                        } else {
                            tableName = key;
                        }
                        //获取table 权限, 此处不需要检测空值, 无设置则自动继承父级权限
                        UserPrivilegesConfig.TablePrivilege tablePrivilege = schemaPrivilege.getTablePrivilege(tableName);
                        if (tablePrivilege.getDml()[index] > 0) {
                            isPassed = true;
                        }
                    } else {
                        //skip
                        isPassed = true;
                    }
                } else {
                    //skip
                    isPassed = true;
                }
            } else {
                //skip
                isPassed = true;
            }
        } else {
            //skip
            isPassed = true;
        }
    } else {
        //skip
        isPassed = true;
    }
    if (!isPassed) {
        ALARM.error(new StringBuilder().append(Alarms.DML_ATTACK).append("[sql=").append(sql).append(",user=").append(user).append(']').toString());
    }
    return isPassed;
}

Example 2 with SQLDeleteStatement

use of com.alibaba.druid.sql.ast.statement.SQLDeleteStatement in project Mycat-Server by MyCATApache.

the class DruidMycatRouteStrategy method routeDisTable.

private RouteResultset routeDisTable(SQLStatement statement, RouteResultset rrs) throws SQLSyntaxErrorException {
    SQLTableSource tableSource = null;
    if (statement instanceof SQLInsertStatement) {
        SQLInsertStatement insertStatement = (SQLInsertStatement) statement;
        tableSource = insertStatement.getTableSource();
        for (RouteResultsetNode node : rrs.getNodes()) {
            SQLExprTableSource from2 = getDisTable(tableSource, node);
            insertStatement.setTableSource(from2);
            node.setStatement(insertStatement.toString());
        }
    }
    if (statement instanceof SQLDeleteStatement) {
        SQLDeleteStatement deleteStatement = (SQLDeleteStatement) statement;
        tableSource = deleteStatement.getTableSource();
        for (RouteResultsetNode node : rrs.getNodes()) {
            SQLExprTableSource from2 = getDisTable(tableSource, node);
            deleteStatement.setTableSource(from2);
            node.setStatement(deleteStatement.toString());
        }
    }
    if (statement instanceof SQLUpdateStatement) {
        SQLUpdateStatement updateStatement = (SQLUpdateStatement) statement;
        tableSource = updateStatement.getTableSource();
        for (RouteResultsetNode node : rrs.getNodes()) {
            SQLExprTableSource from2 = getDisTable(tableSource, node);
            updateStatement.setTableSource(from2);
            node.setStatement(updateStatement.toString());
        }
    }
    return rrs;
}

Example 3 with SQLDeleteStatement

use of com.alibaba.druid.sql.ast.statement.SQLDeleteStatement in project druid by alibaba.

the class SQLDeleteBuilderImpl method whereAnd.

@Override
public SQLDeleteBuilder whereAnd(String expr) {
    SQLDeleteStatement delete = getSQLDeleteStatement();
    SQLExpr exprObj = SQLUtils.toSQLExpr(expr, dbType);
    SQLExpr newCondition = SQLUtils.buildCondition(SQLBinaryOperator.BooleanAnd, exprObj, false, delete.getWhere());
    delete.setWhere(newCondition);
    return this;
}

Example 4 with SQLDeleteStatement

use of com.alibaba.druid.sql.ast.statement.SQLDeleteStatement in project druid by alibaba.

the class SQLUtils method addCondition.

public static void addCondition(SQLStatement stmt, SQLBinaryOperator op, SQLExpr condition, boolean left) {
    if (stmt instanceof SQLSelectStatement) {
        SQLSelectQuery query = ((SQLSelectStatement) stmt).getSelect().getQuery();
        if (query instanceof SQLSelectQueryBlock) {
            SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) query;
            SQLExpr newCondition = buildCondition(op, condition, left, queryBlock.getWhere());
            queryBlock.setWhere(newCondition);
        } else {
            throw new IllegalArgumentException("add condition not support " + stmt.getClass().getName());
        }
        return;
    }
    if (stmt instanceof SQLDeleteStatement) {
        SQLDeleteStatement delete = (SQLDeleteStatement) stmt;
        SQLExpr newCondition = buildCondition(op, condition, left, delete.getWhere());
        delete.setWhere(newCondition);
        return;
    }
    if (stmt instanceof SQLUpdateStatement) {
        SQLUpdateStatement update = (SQLUpdateStatement) stmt;
        SQLExpr newCondition = buildCondition(op, condition, left, update.getWhere());
        update.setWhere(newCondition);
        return;
    }
    throw new IllegalArgumentException("add condition not support " + stmt.getClass().getName());
}

Example 5 with SQLDeleteStatement

use of com.alibaba.druid.sql.ast.statement.SQLDeleteStatement in project druid by alibaba.

the class SQLDeleteBuilderImpl method from.

@Override
public SQLDeleteBuilder from(String table, String alias) {
    SQLDeleteStatement delete = getSQLDeleteStatement();
    SQLExprTableSource from = new SQLExprTableSource(new SQLIdentifierExpr(table), alias);
    delete.setTableSource(from);
    return this;
}