Examples with IllegalSQLObjectViolation com.alibaba.druid.wall.violation.IllegalSQLObjectViolation used on opensource projects

Example 6 with IllegalSQLObjectViolation

use of com.alibaba.druid.wall.violation.IllegalSQLObjectViolation in project druid by alibaba.

the class MySqlWallVisitor method visit.

public boolean visit(SQLPropertyExpr x) {
    if (x.getOwner() instanceof SQLVariantRefExpr) {
        SQLVariantRefExpr varExpr = (SQLVariantRefExpr) x.getOwner();
        SQLObject parent = x.getParent();
        String varName = varExpr.getName();
        if (varName.equalsIgnoreCase("@@session") || varName.equalsIgnoreCase("@@global")) {
            if (!(parent instanceof SQLSelectItem) && !(parent instanceof SQLAssignItem)) {
                violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable in condition not allow", toSQL(x)));
                return false;
            }
            if (!checkVar(x.getParent(), x.getName())) {
                boolean isTop = WallVisitorUtils.isTopNoneFromSelect(this, x);
                if (!isTop) {
                    boolean allow = true;
                    if (isDeny(varName) && (WallVisitorUtils.isWhereOrHaving(x) || WallVisitorUtils.checkSqlExpr(varExpr))) {
                        allow = false;
                    }
                    if (!allow) {
                        violations.add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + x.getName(), toSQL(x)));
                    }
                }
            }
            return false;
        }
    }
    WallVisitorUtils.check(this, x);
    return true;
}

Example 7 with IllegalSQLObjectViolation

use of com.alibaba.druid.wall.violation.IllegalSQLObjectViolation in project druid by alibaba.

the class MySqlWallVisitor method visit.

@Override
public boolean visit(SQLLimit x) {
    if (x.getRowCount() instanceof SQLNumericLiteralExpr) {
        WallContext context = WallContext.current();
        int rowCount = ((SQLNumericLiteralExpr) x.getRowCount()).getNumber().intValue();
        if (rowCount == 0) {
            if (context != null) {
                context.incrementWarnings();
            }
            if (!provider.getConfig().isLimitZeroAllow()) {
                this.getViolations().add(new IllegalSQLObjectViolation(ErrorCode.LIMIT_ZERO, "limit row 0", this.toSQL(x)));
            }
        }
    }
    return true;
}

Example 8 with IllegalSQLObjectViolation

use of com.alibaba.druid.wall.violation.IllegalSQLObjectViolation in project druid by alibaba.

the class PGWallVisitor method visit.

public boolean visit(SQLIdentifierExpr x) {
    String name = x.getName();
    name = WallVisitorUtils.form(name);
    if (config.isVariantCheck() && config.getDenyVariants().contains(name)) {
        getViolations().add(new IllegalSQLObjectViolation(ErrorCode.VARIANT_DENY, "variable not allow : " + name, toSQL(x)));
    }
    return true;
}