Examples with MySqlReplaceStatement com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement used on opensource projects

Example 1 with MySqlReplaceStatement

use of com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement in project Mycat-Server by MyCATApache.

the class MycatPrivileges method checkDmlPrivilege.

// 审计SQL权限
@Override
public boolean checkDmlPrivilege(String user, String schema, String sql) {
    if (schema == null) {
        return true;
    }
    boolean isPassed = false;
    MycatConfig conf = MycatServer.getInstance().getConfig();
    UserConfig userConfig = conf.getUsers().get(user);
    if (userConfig != null) {
        UserPrivilegesConfig userPrivilege = userConfig.getPrivilegesConfig();
        if (userPrivilege != null && userPrivilege.isCheck()) {
            UserPrivilegesConfig.SchemaPrivilege schemaPrivilege = userPrivilege.getSchemaPrivilege(schema);
            if (schemaPrivilege != null) {
                String tableName = null;
                int index = -1;
                //TODO 此处待优化，寻找更优SQL 解析器
                SQLStatementParser parser = new MycatStatementParser(sql);
                SQLStatement stmt = parser.parseStatement();
                if (stmt instanceof MySqlReplaceStatement || stmt instanceof SQLInsertStatement) {
                    index = 0;
                } else if (stmt instanceof SQLUpdateStatement) {
                    index = 1;
                } else if (stmt instanceof SQLSelectStatement) {
                    index = 2;
                } else if (stmt instanceof SQLDeleteStatement) {
                    index = 3;
                }
                if (index > -1) {
                    SchemaStatVisitor schemaStatVisitor = new MycatSchemaStatVisitor();
                    stmt.accept(schemaStatVisitor);
                    String key = schemaStatVisitor.getCurrentTable();
                    if (key != null) {
                        if (key.contains("`")) {
                            key = key.replaceAll("`", "");
                        }
                        int dotIndex = key.indexOf(".");
                        if (dotIndex > 0) {
                            tableName = key.substring(dotIndex + 1);
                        } else {
                            tableName = key;
                        }
                        //获取table 权限, 此处不需要检测空值, 无设置则自动继承父级权限
                        UserPrivilegesConfig.TablePrivilege tablePrivilege = schemaPrivilege.getTablePrivilege(tableName);
                        if (tablePrivilege.getDml()[index] > 0) {
                            isPassed = true;
                        }
                    } else {
                        //skip
                        isPassed = true;
                    }
                } else {
                    //skip
                    isPassed = true;
                }
            } else {
                //skip
                isPassed = true;
            }
        } else {
            //skip
            isPassed = true;
        }
    } else {
        //skip
        isPassed = true;
    }
    if (!isPassed) {
        ALARM.error(new StringBuilder().append(Alarms.DML_ATTACK).append("[sql=").append(sql).append(",user=").append(user).append(']').toString());
    }
    return isPassed;
}

Example 2 with MySqlReplaceStatement

use of com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement in project druid by alibaba.

the class WallVisitorUtils method preVisitCheck.

public static void preVisitCheck(WallVisitor visitor, SQLObject x) {
    WallConfig config = visitor.getProvider().getConfig();
    if (!(x instanceof SQLStatement)) {
        return;
    }
    boolean allow = false;
    int errorCode;
    String denyMessage;
    if (x instanceof SQLInsertStatement) {
        allow = config.isInsertAllow();
        denyMessage = "insert not allow";
        errorCode = ErrorCode.INSERT_NOT_ALLOW;
    } else if (x instanceof SQLSelectStatement) {
        allow = true;
        denyMessage = "select not allow";
        errorCode = ErrorCode.SELECT_NOT_ALLOW;
    } else if (x instanceof SQLDeleteStatement) {
        allow = config.isDeleteAllow();
        denyMessage = "delete not allow";
        errorCode = ErrorCode.DELETE_NOT_ALLOW;
    } else if (x instanceof SQLUpdateStatement) {
        allow = config.isUpdateAllow();
        denyMessage = "update not allow";
        errorCode = ErrorCode.UPDATE_NOT_ALLOW;
    } else if (x instanceof OracleMultiInsertStatement) {
        allow = true;
        denyMessage = "multi-insert not allow";
        errorCode = ErrorCode.INSERT_NOT_ALLOW;
    } else if (x instanceof SQLMergeStatement) {
        allow = config.isMergeAllow();
        denyMessage = "merge not allow";
        errorCode = ErrorCode.MERGE_NOT_ALLOW;
    } else if (x instanceof SQLCallStatement || x instanceof SQLServerExecStatement) {
        allow = config.isCallAllow();
        denyMessage = "call not allow";
        errorCode = ErrorCode.CALL_NOT_ALLOW;
    } else if (x instanceof SQLTruncateStatement) {
        allow = config.isTruncateAllow();
        denyMessage = "truncate not allow";
        errorCode = ErrorCode.TRUNCATE_NOT_ALLOW;
    } else if (//
    x instanceof SQLCreateTableStatement || //
    x instanceof SQLCreateIndexStatement || //
    x instanceof SQLCreateViewStatement || //
    x instanceof SQLCreateTriggerStatement || //
    x instanceof SQLCreateSequenceStatement) {
        allow = config.isCreateTableAllow();
        denyMessage = "create table not allow";
        errorCode = ErrorCode.CREATE_TABLE_NOT_ALLOW;
    } else if (x instanceof SQLAlterTableStatement) {
        allow = config.isAlterTableAllow();
        denyMessage = "alter table not allow";
        errorCode = ErrorCode.ALTER_TABLE_NOT_ALLOW;
    } else if (//
    x instanceof SQLDropTableStatement || //
    x instanceof SQLDropIndexStatement || //
    x instanceof SQLDropViewStatement || //
    x instanceof SQLDropTriggerStatement || //
    x instanceof SQLDropSequenceStatement || //
    x instanceof SQLDropProcedureStatement) {
        allow = config.isDropTableAllow();
        denyMessage = "drop table not allow";
        errorCode = ErrorCode.DROP_TABLE_NOT_ALLOW;
    } else if (//
    x instanceof MySqlSetCharSetStatement || //
    x instanceof MySqlSetNamesStatement || //
    x instanceof SQLSetStatement || x instanceof SQLServerSetStatement) {
        allow = config.isSetAllow();
        denyMessage = "set not allow";
        errorCode = ErrorCode.SET_NOT_ALLOW;
    } else if (x instanceof MySqlReplaceStatement) {
        allow = config.isReplaceAllow();
        denyMessage = "replace not allow";
        errorCode = ErrorCode.REPLACE_NOT_ALLOW;
    } else if (x instanceof MySqlDescribeStatement) {
        allow = config.isDescribeAllow();
        denyMessage = "describe not allow";
        errorCode = ErrorCode.DESC_NOT_ALLOW;
    } else if (x instanceof MySqlShowStatement || x instanceof PGShowStatement || x instanceof SQLShowTablesStatement) {
        allow = config.isShowAllow();
        denyMessage = "show not allow";
        errorCode = ErrorCode.SHOW_NOT_ALLOW;
    } else if (x instanceof MySqlCommitStatement || x instanceof SQLServerCommitStatement) {
        allow = config.isCommitAllow();
        denyMessage = "commit not allow";
        errorCode = ErrorCode.COMMIT_NOT_ALLOW;
    } else if (x instanceof SQLRollbackStatement) {
        allow = config.isRollbackAllow();
        denyMessage = "rollback not allow";
        errorCode = ErrorCode.ROLLBACK_NOT_ALLOW;
    } else if (x instanceof SQLUseStatement) {
        allow = config.isUseAllow();
        denyMessage = "use not allow";
        errorCode = ErrorCode.USE_NOT_ALLOW;
    } else if (x instanceof MySqlRenameTableStatement) {
        allow = config.isRenameTableAllow();
        denyMessage = "rename table not allow";
        errorCode = ErrorCode.RENAME_TABLE_NOT_ALLOW;
    } else if (x instanceof MySqlHintStatement) {
        allow = config.isHintAllow();
        denyMessage = "hint not allow";
        errorCode = ErrorCode.HINT_NOT_ALLOW;
    } else if (x instanceof MySqlLockTableStatement) {
        allow = config.isLockTableAllow();
        denyMessage = "lock table not allow";
        errorCode = ErrorCode.LOCK_TABLE_NOT_ALLOW;
    } else if (x instanceof SQLStartTransactionStatement) {
        allow = config.isStartTransactionAllow();
        denyMessage = "start transaction not allow";
        errorCode = ErrorCode.START_TRANSACTION_NOT_ALLOW;
    } else if (x instanceof SQLBlockStatement) {
        allow = config.isBlockAllow();
        denyMessage = "block statement not allow";
        errorCode = ErrorCode.BLOCK_NOT_ALLOW;
    } else {
        allow = config.isNoneBaseStatementAllow();
        errorCode = ErrorCode.NONE_BASE_STATEMENT_NOT_ALLOW;
        denyMessage = x.getClass() + " not allow";
    }
    if (!allow) {
        addViolation(visitor, errorCode, denyMessage, x);
    }
}

Example 3 with MySqlReplaceStatement

use of com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement in project druid by alibaba.

the class MySqlStatementParser method parseStatementListDialect.

public boolean parseStatementListDialect(List<SQLStatement> statementList) {
    if (lexer.token() == Token.KILL) {
        SQLStatement stmt = parseKill();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("PREPARE")) {
        MySqlPrepareStatement stmt = parsePrepare();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("EXECUTE")) {
        MySqlExecuteStatement stmt = parseExecute();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("DEALLOCATE")) {
        MysqlDeallocatePrepareStatement stmt = parseDeallocatePrepare();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("LOAD")) {
        SQLStatement stmt = parseLoad();
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.REPLACE) {
        MySqlReplaceStatement stmt = parseReplicate();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("START")) {
        SQLStartTransactionStatement stmt = parseStart();
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.SHOW) {
        SQLStatement stmt = parseShow();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals(BINLOG)) {
        SQLStatement stmt = parseBinlog();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals(RESET)) {
        SQLStatement stmt = parseReset();
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.ANALYZE) {
        SQLStatement stmt = parseAnalyze();
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.OPTIMIZE) {
        SQLStatement stmt = parseOptimize();
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("HELP")) {
        lexer.nextToken();
        MySqlHelpStatement stmt = new MySqlHelpStatement();
        stmt.setContent(this.exprParser.primary());
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.DESC || identifierEquals(DESCRIBE)) {
        SQLStatement stmt = parseDescribe();
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.LOCK) {
        lexer.nextToken();
        String val = lexer.stringVal();
        boolean isLockTables = TABLES.equalsIgnoreCase(val) && lexer.token() == Token.IDENTIFIER;
        boolean isLockTable = "TABLE".equalsIgnoreCase(val) && lexer.token() == Token.TABLE;
        if (isLockTables || isLockTable) {
            lexer.nextToken();
        } else {
            setErrorEndPos(lexer.pos());
            throw new ParserException("syntax error, expect TABLES or TABLE, actual " + lexer.token());
        }
        MySqlLockTableStatement stmt = new MySqlLockTableStatement();
        stmt.setTableSource(this.exprParser.name());
        if (identifierEquals(READ)) {
            lexer.nextToken();
            if (identifierEquals(LOCAL)) {
                lexer.nextToken();
                stmt.setLockType(LockType.READ_LOCAL);
            } else {
                stmt.setLockType(LockType.READ);
            }
        } else if (identifierEquals(WRITE)) {
            stmt.setLockType(LockType.WRITE);
        } else if (identifierEquals(LOW_PRIORITY)) {
            lexer.nextToken();
            acceptIdentifier(WRITE);
            stmt.setLockType(LockType.LOW_PRIORITY_WRITE);
        } else {
            throw new ParserException("syntax error, expect READ or WRITE, actual " + lexer.token());
        }
        if (lexer.token() == Token.HINT) {
            stmt.setHints(this.exprParser.parseHints());
        }
        statementList.add(stmt);
        return true;
    }
    if (identifierEquals("UNLOCK")) {
        lexer.nextToken();
        String val = lexer.stringVal();
        boolean isUnLockTables = TABLES.equalsIgnoreCase(val) && lexer.token() == Token.IDENTIFIER;
        boolean isUnLockTable = "TABLE".equalsIgnoreCase(val) && lexer.token() == Token.TABLE;
        statementList.add(new MySqlUnlockTablesStatement());
        if (isUnLockTables || isUnLockTable) {
            lexer.nextToken();
        } else {
            setErrorEndPos(lexer.pos());
            throw new ParserException("syntax error, expect TABLES or TABLE, actual " + lexer.token());
        }
        return true;
    }
    if (lexer.token() == Token.HINT) {
        List<SQLCommentHint> hints = this.exprParser.parseHints();
        boolean tddlSelectHints = false;
        if (hints.size() == 1 && statementList.size() == 0 && lexer.token() == Token.SELECT) {
            SQLCommentHint hint = hints.get(0);
            String hintText = hint.getText();
            if (hintText.startsWith("+TDDL")) {
                tddlSelectHints = true;
            }
        }
        if (tddlSelectHints) {
            SQLSelectStatement stmt = (SQLSelectStatement) this.parseStatement();
            stmt.setHeadHints(hints);
            statementList.add(stmt);
            return true;
        }
        MySqlHintStatement stmt = new MySqlHintStatement();
        stmt.setHints(hints);
        statementList.add(stmt);
        return true;
    }
    if (lexer.token() == Token.BEGIN) {
        statementList.add(this.parseBlock());
        return true;
    }
    return false;
}

Example 4 with MySqlReplaceStatement

use of com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement in project druid by alibaba.

the class MySqlStatementParser method parseReplicate.

public MySqlReplaceStatement parseReplicate() {
    MySqlReplaceStatement stmt = new MySqlReplaceStatement();
    accept(Token.REPLACE);
    if (lexer.token() == Token.COMMENT) {
        lexer.nextToken();
    }
    if (identifierEquals(LOW_PRIORITY)) {
        stmt.setLowPriority(true);
        lexer.nextToken();
    }
    if (identifierEquals(DELAYED)) {
        stmt.setDelayed(true);
        lexer.nextToken();
    }
    if (lexer.token() == Token.INTO) {
        lexer.nextToken();
    }
    SQLName tableName = exprParser.name();
    stmt.setTableName(tableName);
    if (lexer.token() == Token.LPAREN) {
        lexer.nextToken();
        if (lexer.token() == Token.SELECT) {
            SQLQueryExpr queryExpr = (SQLQueryExpr) this.exprParser.expr();
            stmt.setQuery(queryExpr);
        } else {
            this.exprParser.exprList(stmt.getColumns(), stmt);
        }
        accept(Token.RPAREN);
    }
    if (lexer.token() == Token.VALUES || identifierEquals("VALUE")) {
        lexer.nextToken();
        parseValueClause(stmt.getValuesList(), 0);
    } else if (lexer.token() == Token.SELECT) {
        SQLQueryExpr queryExpr = (SQLQueryExpr) this.exprParser.expr();
        stmt.setQuery(queryExpr);
    } else if (lexer.token() == Token.SET) {
        lexer.nextToken();
        SQLInsertStatement.ValuesClause values = new SQLInsertStatement.ValuesClause();
        stmt.getValuesList().add(values);
        for (; ; ) {
            stmt.addColumn(this.exprParser.name());
            if (lexer.token() == Token.COLONEQ) {
                lexer.nextToken();
            } else {
                accept(Token.EQ);
            }
            values.addValue(this.exprParser.expr());
            if (lexer.token() == (Token.COMMA)) {
                lexer.nextToken();
                continue;
            }
            break;
        }
    } else if (lexer.token() == Token.LPAREN) {
        lexer.nextToken();
        SQLQueryExpr queryExpr = (SQLQueryExpr) this.exprParser.expr();
        stmt.setQuery(queryExpr);
        accept(Token.RPAREN);
    }
    return stmt;
}

Example 5 with MySqlReplaceStatement

use of com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlReplaceStatement in project druid by alibaba.

the class WallVisitorUtils method check.

public static boolean check(WallVisitor visitor, SQLExprTableSource x) {
    final WallTopStatementContext topStatementContext = wallTopStatementContextLocal.get();
    SQLExpr expr = x.getExpr();
    if (expr instanceof SQLPropertyExpr) {
        boolean checkResult = checkSchema(visitor, ((SQLPropertyExpr) expr).getOwner());
        if (!checkResult) {
            return false;
        }
    }
    if (expr instanceof SQLName) {
        String tableName = ((SQLName) expr).getSimpleName();
        WallContext context = WallContext.current();
        if (context != null) {
            WallSqlTableStat tableStat = context.getTableStat(tableName);
            if (tableStat != null) {
                SQLObject parent = x.getParent();
                while (parent instanceof SQLTableSource) {
                    parent = parent.getParent();
                }
                if (parent instanceof SQLSelectQueryBlock) {
                    SQLSelectQueryBlock queryBlock = (SQLSelectQueryBlock) parent;
                    if (x == queryBlock.getInto()) {
                        tableStat.incrementSelectIntoCount();
                    } else {
                        tableStat.incrementSelectCount();
                    }
                } else if (parent instanceof SQLTruncateStatement) {
                    tableStat.incrementTruncateCount();
                } else if (parent instanceof SQLInsertStatement) {
                    tableStat.incrementInsertCount();
                } else if (parent instanceof SQLDeleteStatement) {
                    tableStat.incrementDeleteCount();
                } else if (parent instanceof SQLUpdateStatement) {
                    tableStat.incrementUpdateCount();
                } else if (parent instanceof MySqlReplaceStatement) {
                    tableStat.incrementReplaceCount();
                }
            }
        }
        if (topStatementContext != null && (topStatementContext.fromSysSchema || topStatementContext.fromSysTable)) {
            return true;
        }
        if (visitor.isDenyTable(tableName) && !(topStatementContext != null && topStatementContext.fromPermitTable())) {
            if (isTopStatementWithTableSource(x) || isFirstSelectTableSource(x)) {
                if (topStatementContext != null) {
                    topStatementContext.setFromSysTable(Boolean.TRUE);
                    clearViolation(visitor);
                }
                return false;
            }
            boolean isTopNoneFrom = isTopNoneFromSelect(visitor, x);
            if (isTopNoneFrom) {
                return false;
            }
            addViolation(visitor, ErrorCode.TABLE_DENY, "deny table : " + tableName, x);
            return false;
        }
        if (visitor.getConfig().getPermitTables().contains(tableName)) {
            if (isFirstSelectTableSource(x)) {
                if (topStatementContext != null) {
                    topStatementContext.setFromPermitTable(Boolean.TRUE);
                }
                return false;
            }
        }
    }
    return true;
}