Examples with MySqlWallProvider com.alibaba.druid.wall.spi.MySqlWallProvider used on opensource projects

Example 41 with MySqlWallProvider

use of com.alibaba.druid.wall.spi.MySqlWallProvider in project druid by alibaba.

the class MySqlWallTest_comment method test_false.

public void test_false() throws Exception {
    WallProvider provider = new MySqlWallProvider();
    provider.getConfig().setCommentAllow(false);
    assertTrue(provider.checkValid("/* this is comment */ SELECT id FROM t "));
    assertTrue(provider.checkValid("-- this is comment \n SELECT * FROM t"));
    assertTrue(provider.checkValid("#this is comment \n SELECT * FROM t"));
    assertTrue(provider.checkValid("/*!40101fff*/ select * from t"));
    assertFalse(provider.checkValid("select * from t/*!40101fff*/"));
    assertTrue(provider.checkValid("SELECT * FROM t where a=1 #this is comment \n and b=1"));
    assertTrue(provider.checkValid("SELECT * FROM t where a=1 -- this is comment \n and c=1"));
    assertTrue(provider.checkValid("SELECT * FROM t where a=1 /* this is comment */ and d=1"));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 \n and e=1"));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- AND c=1 \n and f=1"));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */ and g=1"));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 #and c=1 "));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 -- and c=1"));
    assertFalse(provider.checkValid("SELECT * FROM t where a=1 /* and c=1 */"));
}

Example 42 with MySqlWallProvider

use of com.alibaba.druid.wall.spi.MySqlWallProvider in project druid by alibaba.

the class MySqlWallTest_ifnull_2 method test_false.

public void test_false() throws Exception {
    WallProvider provider = new MySqlWallProvider();
    Assert.assertFalse(// 
    provider.checkValid("SELECT * FROM T WHERE FID = ? OR IFNULL(CAST(CURRENT_USER() AS CHAR))"));
    Assert.assertEquals(1, provider.getTableStats().size());
}

Example 43 with MySqlWallProvider

use of com.alibaba.druid.wall.spi.MySqlWallProvider in project druid by alibaba.

the class MySqlWallTest_ifnull_1 method test_false.

public void test_false() throws Exception {
    WallProvider provider = new MySqlWallProvider();
    Assert.assertFalse(// 
    provider.checkValid("SELECT * FROM T WHERE FID = ? OR ISNULL(1) = 0"));
    Assert.assertEquals(1, provider.getTableStats().size());
}

Example 44 with MySqlWallProvider

use of com.alibaba.druid.wall.spi.MySqlWallProvider in project druid by alibaba.

the class MySqlResourceWallTest method test_lock_table.

@Test
public void test_lock_table() throws Exception {
    WallProvider provider = new MySqlWallProvider();
    provider.getConfig().setNoneBaseStatementAllow(true);
    String sql = "lock tables etstsun write";
    WallCheckResult result = provider.check(sql);
    if (result.getViolations().size() > 0) {
        Violation violation = result.getViolations().get(0);
        System.out.println("error () : " + violation.getMessage());
    }
    Assert.assertTrue(provider.checkValid(sql));
    sql = "lock tables etstsun LOW_PRIORITY write";
    result = provider.check(sql);
    if (result.getViolations().size() > 0) {
        Violation violation = result.getViolations().get(0);
        System.out.println("error () : " + violation.getMessage());
    }
    Assert.assertTrue(provider.checkValid(sql));
    sql = "UNLOCK TABLES";
    result = provider.check(sql);
    if (result.getViolations().size() > 0) {
        Violation violation = result.getViolations().get(0);
        System.out.println("error () : " + violation.getMessage());
    }
    Assert.assertTrue(provider.checkValid(sql));
    sql = "lock table dsdfsdf read";
    result = provider.check(sql);
    if (result.getViolations().size() > 0) {
        Violation violation = result.getViolations().get(0);
        System.out.println("error () : " + violation.getMessage());
    }
    Assert.assertTrue(provider.checkValid(sql));
    sql = "lock table dsdfsdf read local";
    result = provider.check(sql);
    if (result.getViolations().size() > 0) {
        Violation violation = result.getViolations().get(0);
        System.out.println("error () : " + violation.getMessage());
    }
    Assert.assertTrue(provider.checkValid(sql));
}

Example 45 with MySqlWallProvider

use of com.alibaba.druid.wall.spi.MySqlWallProvider in project druid by alibaba.

the class MySqlResourceWallTest method test_false.

public void test_false() throws Exception {
    WallProvider provider = new MySqlWallProvider();
    provider.getConfig().setConditionDoubleConstAllow(true);
    provider.getConfig().setUseAllow(true);
    provider.getConfig().setStrictSyntaxCheck(false);
    provider.getConfig().setMultiStatementAllow(true);
    provider.getConfig().setConditionAndAlwayTrueAllow(true);
    provider.getConfig().setNoneBaseStatementAllow(true);
    provider.getConfig().setSelectUnionCheck(false);
    provider.getConfig().setSchemaCheck(true);
    provider.getConfig().setLimitZeroAllow(true);
    provider.getConfig().setCommentAllow(true);
    for (int i = 0; i < items.length; ++i) {
        String sql = items[i];
        if (sql.indexOf("''=''") != -1) {
            continue;
        }
        // if (i <= 121) {
        // continue;
        // }
        WallCheckResult result = provider.check(sql);
        if (result.getViolations().size() > 0) {
            Violation violation = result.getViolations().get(0);
            System.out.println("error (" + i + ") : " + violation.getMessage());
            System.out.println(sql);
            break;
        }
    }
    System.out.println(provider.getViolationCount());
// String sql = "SELECT name, '******' password, createTime from user where name like 'admin' AND (CASE WHEN (7885=7885) THEN 1 ELSE 0 END)";
// Assert.assertFalse(provider.checkValid(sql));
}