Examples with WallCheckResult com.alibaba.druid.wall.WallCheckResult used on opensource projects

Example 6 with WallCheckResult

use of com.alibaba.druid.wall.WallCheckResult in project druid by alibaba.

the class TenantUpdateTest method testMySql.

public void testMySql() throws Exception {
    WallProvider.setTenantValue(123);
    MySqlWallProvider provider = new MySqlWallProvider(config);
    WallCheckResult checkResult = provider.check(sql);
    Assert.assertEquals(0, checkResult.getViolations().size());
    String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
    Assert.assertEquals(expect_sql, resultSql);
}

Example 7 with WallCheckResult

use of com.alibaba.druid.wall.WallCheckResult in project druid by alibaba.

the class TenantDeleteTest method testMySql.

public void testMySql() throws Exception {
    WallProvider.setTenantValue(123);
    MySqlWallProvider provider = new MySqlWallProvider(config);
    WallProvider.setTenantValue("test");
    WallCheckResult checkResult = provider.check(sql);
    Assert.assertEquals(0, checkResult.getViolations().size());
    String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
    Assert.assertEquals(//
    "DELETE FROM orders" + "\nWHERE FID = ?", resultSql);
}

Example 8 with WallCheckResult

use of com.alibaba.druid.wall.WallCheckResult in project druid by alibaba.

the class TenantSelectTest method testMySql2.

public void testMySql2() throws Exception {
    MySqlWallProvider provider = new MySqlWallProvider(config_callback);
    WallCheckResult checkResult = provider.check(sql);
    Assert.assertEquals(0, checkResult.getViolations().size());
    String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
    Assert.assertEquals(expect_sql, resultSql);
}

Example 9 with WallCheckResult

use of com.alibaba.druid.wall.WallCheckResult in project Mycat-Server by MyCATApache.

the class MycatPrivileges method checkFirewallSQLPolicy.

/**
	 * @see https://github.com/alibaba/druid/wiki/%E9%85%8D%E7%BD%AE-wallfilter
	 */
@Override
public boolean checkFirewallSQLPolicy(String user, String sql) {
    boolean isPassed = true;
    if (contextLocal.get() == null) {
        FirewallConfig firewallConfig = MycatServer.getInstance().getConfig().getFirewall();
        if (firewallConfig != null) {
            if (firewallConfig.isCheck()) {
                contextLocal.set(firewallConfig.getProvider());
                check = true;
            }
        }
    }
    if (check) {
        WallCheckResult result = contextLocal.get().check(sql);
        // 修复 druid 防火墙在处理SHOW FULL TABLES WHERE Table_type != 'VIEW' 的时候存在的 BUG
        List<SQLStatement> stmts = result.getStatementList();
        if (!stmts.isEmpty() && !(stmts.get(0) instanceof SQLShowTablesStatement)) {
            if (!result.getViolations().isEmpty()) {
                isPassed = false;
                ALARM.warn("Firewall to intercept the '" + user + "' unsafe SQL , errMsg:" + result.getViolations().get(0).getMessage() + " \r\n " + sql);
            }
        }
    }
    return isPassed;
}

Example 10 with WallCheckResult

use of com.alibaba.druid.wall.WallCheckResult in project druid by alibaba.

the class TenantInsertTest method testMySql3.

public void testMySql3() throws Exception {
    String insert_sql = "INSERT INTO orders (ID, NAME) VALUES (1, \"KIKI\")";
    String expect_sql = //
    "INSERT INTO orders (ID, NAME, tenant)" + "\nVALUES (1, 'KIKI', 123)";
    {
        MySqlWallProvider provider = new MySqlWallProvider(config_callback);
        WallCheckResult checkResult = provider.check(insert_sql);
        Assert.assertEquals(0, checkResult.getViolations().size());
        String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
        Assert.assertEquals(expect_sql, resultSql);
    }
    {
        WallProvider.setTenantValue(123);
        MySqlWallProvider provider = new MySqlWallProvider(config);
        WallCheckResult checkResult = provider.check(insert_sql);
        Assert.assertEquals(0, checkResult.getViolations().size());
        String resultSql = SQLUtils.toSQLString(checkResult.getStatementList(), JdbcConstants.MYSQL);
        Assert.assertEquals(expect_sql, resultSql);
    }
}