JAVAWEB开发实现对请求头、请求参数的过滤

1、服务器容器取得客户端发送的参数都是通过HttpServletRequest来获取的,HttpServletRequest存在如下三种获取参数的方法：

• getParameter(name)，返回单个值。
• getParameterValues(name)，返回一个数组。
• getParameterMap()，把客户端提交参数封装为一个Map返回。K：name，V：value。

当我们使用servlet的时候一般都是使用前两种，struts1使用的第2种，struts2(xwork)则使用的第3种 。

2、 根据JavaEE servlet2.5规范要求，ServletRequest.getParameterMap()需返回一个immutable（不可改变）的java.util.Map实现，tomcat在这方面没有严格遵照规范，而weblogic严格遵照规范。JavaEE规范之所以这样要求，是出于“安全因素”的考虑。规范描述如下:
public java.util.Map getParameterMap()

Returns a java.util.Map of the parameters of this request. Request parameters are extra information sent with the request. For HTTP servlets, parameters are contained in the query string or posted form data.

Returns: an immutable java.util.Map containing parameter names as keys and parameter values as map values. The keys in the parameter map are of type String. The values in the parameter map are of type String array.

3、对 2 中描述的情况进行代码调整，已在tomcat、weblogic下验证过，其中包括：请求装饰类、过滤器、web.xml下配置过滤器：

请求装饰类：JzHttpServletRequest

package com.juno.fw.wrapper;

import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Map.Entry;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang3.StringUtils;

/**
 * 使用装饰模块模式(Decorator)包装HttpServletRequest对象，实现请求头、请求参数的特定字符转义功能。
 * 
 * @author       Juno
 * @since		 1.6
 * @version      1.0
 * @date 	     2016.04.14
 * @date 	     Juno update at 2016.12.05
 */
public class JnHttpServletRequest extends HttpServletRequestWrapper {

    public HttpServletRequest request;
    public Map<String, String[]> params = new HashMap<String, String[]>(); 

    public JnHttpServletRequest(HttpServletRequest request) {
    	
        super(request);
        this.request = request;
        // 创建对象时，将immutable请求对象MAP复制到本实例的内部对象params中
        // 通过过滤params以实现过虑请求参数的特定字符
        this.params.putAll(request.getParameterMap()); 
    }

    @Override
	public String getHeader(String name) {
    	
    	String value = this.request.getHeader(name);
        if (value == null) {
            return null;
        }
        return filterDatas(value);
        // return super.getHeader(name);
	}

    @Override
    public String getParameter(String name) {
    	
    	
    	String value = super.getParameter(name);
    	if (value == null) {
            return null;
        }
    	return filterDatas(value);
    	
    	// return super.getParameter(name);
    }
    
    @Override
    public String[] getParameterValues(String name) {
        
        String[] values = super.getParameterValues(name);
        if (values != null) {
            for (int i = 0; i < values.length; i++) {
                values[i] = filterDatas(values[i]);
            }
        }
        return values;
        // return super.getParameterValues(name);
    }
    
    /*
     * STRUTS2调用此方法获取请求参数
     * 
     * WEBLOGIC下不允许修改request.getParameterMap()返回的MAP对象
     * 
     * 
     * @see javax.servlet.ServletRequestWrapper#getParameterMap()
     */
    @Override
    public Map<String, String[]> getParameterMap() {
    
    	// HashMap<String, String[]> paramMap = (HashMap<String, String[]>) super.getParameterMap();

        for (Iterator<Entry<String, String[]>> iterator = params.entrySet().iterator(); iterator.hasNext(); ) {
            Map.Entry<String, String[]> entry = (Map.Entry<String, String[]>) iterator.next();
            String[] values = (String[]) entry.getValue();
            for (int i = 0; i < values.length; i++) {
                if (values[i] instanceof String) {
                    values[i] = filterDatas(values[i]);
                }
            }
            entry.setValue(values);
        }
        
        return params;
        // super.getParameterMap();
    }
    
	/**
	 * 过滤参数内容中的敏感字符
	 * 
	 * @param input 被过滤字符串
	 * @return
	 * @author Juno add at 2016.09.05.
	 * @author Juno update at 2016.12.05.
	 */
	private String filterDatas(String input) {
		
		if (StringUtils.isBlank(input)) {
			return "";
		}
		// 过滤敏感字符
		return input.replaceAll("\\s+\'|\'\\s+|\\s+\"|\"\\s+|<|>|(?i)\\s+or\\s+|(?i)\\s+and\\s+|(?i)exec\\s+|(?i)insert\\s+|(?i)select\\s+|(?i)delete\\s+|(?i)update\\s+|(?i)count\\s+|(?i)chr\\s+|(?i)mid\\s+|(?i)master\\s+|(?i)truncate\\s+|(?i)char\\s+|(?i)declare\\s+|(?i)script\\s+|(?i)frame\\s+|(?i)etc\\s+|(?i)style\\s+|(?i)expression\\s+", "");
	}
}

过滤器类：

package com.jz.org.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import com.jz.org.wrapper.JzHttpServletRequest;

/**
 * HTTP请求头、请求参数等的转义过滤器
 * 
 * @author       Juno
 * @since		 1.6
 * @version      1.0
 * @date 	     Juno add at 2016.04.14
 */
public class JzServletRequestFilter implements Filter {

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;

        JzHttpServletRequest jzHttpServletRequest = new JzHttpServletRequest(httpServletRequest);
        
        chain.doFilter(jzHttpServletRequest, response);
    }

    public void init(FilterConfig filterConfig) throws ServletException {
        
    }
    
    public void destroy() {
        
    }
}

过滤器配置：

  	<!-- 请求头、请求参数等的转义过滤器-->
  	<filter>
		<filter-name>JzServletRequestFilter</filter-name>
		<filter-class>com.jz.org.filter.JzServletRequestFilter</filter-class>
  	</filter>

	<filter-mapping>
		<filter-name>JzServletRequestFilter</filter-name>
		<url-pattern>/*</url-pattern>
  	</filter-mapping>

 

转载于:https://my.oschina.net/u/1176770/blog/801203