BaseServlet响应处理
封装一个类统一处理跳转目标
/**
* 中央控制器:统一控制客户端的请求跳转目标
* @Author mrchai 2020/8/27 8:58
*/
public class BaseServlet extends HttpServlet {
@Override
protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
//获取需要执行的方法名称
String methodName = req.getParameter("method");
try {
//根据方法名获取需要执行的方法对象
Method method = this.getClass().getMethod(methodName,HttpServletRequest.class,HttpServletResponse.class);
//执行servlet目标方法,并且获取方法的返回值
Object obj = method.invoke(this,req,resp);
//当返回值不为null时才处理跳转
if(Objects.nonNull(obj)){
//将返回值转换为String类型
String target = obj.toString();
if(target.startsWith("redirect:")){
//重定向
target = target.substring("redirect:".length());
resp.sendRedirect(target);
}else{
//请求转发
req.getRequestDispatcher(target).forward(req,resp);
}
}
} catch (NoSuchMethodException e) {
e.printStackTrace();
} catch (IllegalAccessException e) {
e.printStackTrace();
} catch (InvocationTargetException e) {
e.printStackTrace();
}
}
}
具体使用
@WebServlet("/user")
public class UserServlet extends BaseServlet{
public String login(HttpServletRequest request, HttpServletResponse response){
System.out.println("执行登录!");
//重定向
return "redirect:success.jsp";
}
public String reg(HttpServletRequest request, HttpServletResponse response){
System.out.println("执行注册");
//请求转发
// return "redirect:user?method=userList";
return userList(request, response);
}
public String userList(HttpServletRequest request,HttpServletResponse response){
System.out.println("查询用户列表");
return "redirect:list.jsp";
}
public void modifyPwd(HttpServletRequest request, HttpServletResponse response){
}
public void modifyStatus(HttpServletRequest request, HttpServletResponse response){
}
}
非法访问过滤处理
/**
* 拦截所有对/amdin/*下的资源
*/
@WebFilter("/admin/*")
public class LoginFilter implements Filter {
@Override
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
//将ServletRequest转换为HttpServletRequest
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) resp;
//从session中获取用户信息
Object obj = request.getSession().getAttribute("user");
if(obj != null){
//说明用户已登录,放行
chain.doFilter(request,response);
}else{
//强行跳转到登录页面
// response.sendRedirect("/login.jsp");
request.setAttribute("msg","亲,登录后再试!");
request.getRequestDispatcher("/login.jsp").forward(request,response);
}
}
}
xss过滤
编写request包装器(XssRequest.java)
处理特殊字符: <>
/**
* 请求包装器
* @author mrchai
*/
public class XssRequest extends HttpServletRequestWrapper{
public XssRequest(HttpServletRequest request) {
super(request);
}
@Override
public String getParameter(String name) {
String value = super.getParameter(name);
return handler(value);
}
@Override
public String[] getParameterValues(String name) {
//根据指定name属性获取所有的value值集合(未经处理的数据)
String[] values = super.getParameterValues(name);
if(Objects.isNull(values)){
return null;
}
//创建新数组存储处理过之后的数据
String[] newValues = new String[values.length];
//循环遍历未经处理的数据并进行处理后存入新数组中
for (int i = 0; i < values.length; i++) {
newValues[i] = handler(values[i]);
}
return newValues;
}
/**核心转换方法,实现将特殊字符替换为安全的文本*/
public String handler(String value){
if(Objects.isNull(value)){
return null;
}
// 原理为替换原本请求内容中的特殊字符
// value = value.replaceAll(">", ">")
// .replaceAll("<", "<");
//通过工具类对字符串不解析html代码(需导入commons-lang和commons-text包)
value = StringEscapeUtils.escapeHtml4(value);
return value;
}
}
编写过滤器类(XssFilter.java)
@WebFilter("/*")
public class XssFilter implements Filter{
@Override
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
throws IOException, ServletException {
System.out.println("xss过滤");
//将ServletRequest强制转换为HttpServletRequest
HttpServletRequest request = (HttpServletRequest)req;
//执行过滤器链(放行请求到下一个过滤器)
chain.doFilter(new XssRequest(request), resp);
}
}
监听器使用
@WebListener
public class OnlineListener implements HttpSessionListener {
private static int counter;
@Override
public void sessionCreated(HttpSessionEvent se) {
//session被创建时执行
System.out.println("session创建-->"+se.getSession().getId());
counter++;
//获取Servlet上下文(application)
ServletContext application = se.getSession().getServletContext();
application.setAttribute("counter",counter);
}
@Override
public void sessionDestroyed(HttpSessionEvent se) {
//session被销毁时执行
System.out.println("session销毁==>"+se.getSession().getId());
counter--;
ServletContext application = se.getSession().getServletContext();
application.setAttribute("counter",counter);
}
}