过滤器

BaseServlet响应处理

封装一个类统一处理跳转目标

/**
 * 中央控制器：统一控制客户端的请求跳转目标
 * @Author mrchai 2020/8/27 8:58
 */
public class BaseServlet extends HttpServlet {

    @Override
    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //获取需要执行的方法名称
        String methodName = req.getParameter("method");
        try {
            //根据方法名获取需要执行的方法对象
            Method method = this.getClass().getMethod(methodName,HttpServletRequest.class,HttpServletResponse.class);
            //执行servlet目标方法，并且获取方法的返回值
            Object obj = method.invoke(this,req,resp);
            //当返回值不为null时才处理跳转
            if(Objects.nonNull(obj)){
                //将返回值转换为String类型
                String target = obj.toString();
                if(target.startsWith("redirect:")){
                    //重定向
                    target = target.substring("redirect:".length());
                    resp.sendRedirect(target);
                }else{
                    //请求转发
                    req.getRequestDispatcher(target).forward(req,resp);
                }
            }
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        } catch (InvocationTargetException e) {
            e.printStackTrace();
        }
    }
}

具体使用

@WebServlet("/user")
public class UserServlet extends BaseServlet{

    public String login(HttpServletRequest request, HttpServletResponse response){
        System.out.println("执行登录！");
        //重定向
        return "redirect:success.jsp";
    }

    public String reg(HttpServletRequest request, HttpServletResponse response){
        System.out.println("执行注册");
        //请求转发
//        return "redirect:user?method=userList";
        return userList(request, response);
    }

    public String userList(HttpServletRequest request,HttpServletResponse response){
        System.out.println("查询用户列表");
        return "redirect:list.jsp";
    }

    public void modifyPwd(HttpServletRequest request, HttpServletResponse response){

    }

    public void modifyStatus(HttpServletRequest request, HttpServletResponse response){

    }

}

非法访问过滤处理

/**
* 拦截所有对/amdin/*下的资源
*/
@WebFilter("/admin/*")
public class LoginFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
        //将ServletRequest转换为HttpServletRequest
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) resp;
        //从session中获取用户信息
        Object obj = request.getSession().getAttribute("user");
        if(obj != null){
            //说明用户已登录，放行
            chain.doFilter(request,response);
        }else{
            //强行跳转到登录页面
            //            response.sendRedirect("/login.jsp");
            request.setAttribute("msg","亲，登录后再试!");
            request.getRequestDispatcher("/login.jsp").forward(request,response);
        }
    }
}

xss过滤

编写request包装器(XssRequest.java)

处理特殊字符: <>

/**
 * 请求包装器
 * @author mrchai
 */
public class XssRequest extends HttpServletRequestWrapper{

	public XssRequest(HttpServletRequest request) {
		super(request);
	}

	@Override
	public String getParameter(String name) {
		String value = super.getParameter(name);
		return handler(value);
	}

	@Override
	public String[] getParameterValues(String name) {
		//根据指定name属性获取所有的value值集合(未经处理的数据)
		String[] values = super.getParameterValues(name);
		if(Objects.isNull(values)){
			return null;
		}
		//创建新数组存储处理过之后的数据
		String[] newValues = new String[values.length];
		//循环遍历未经处理的数据并进行处理后存入新数组中
		for (int i = 0; i < values.length; i++) {
			newValues[i] = handler(values[i]);
		}
		return newValues;
	}
	
	/**核心转换方法，实现将特殊字符替换为安全的文本*/
	public String handler(String value){
		if(Objects.isNull(value)){
			return null;
		}
        
//		原理为替换原本请求内容中的特殊字符		
//		value = value.replaceAll(">", "&gt;")
//				.replaceAll("<", "&lt;");
		
		//通过工具类对字符串不解析html代码（需导入commons-lang和commons-text包）
		value = StringEscapeUtils.escapeHtml4(value);
		return value;
	}
}

编写过滤器类(XssFilter.java)

@WebFilter("/*")
public class XssFilter implements Filter{

    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
        throws IOException, ServletException {
        System.out.println("xss过滤");
        //将ServletRequest强制转换为HttpServletRequest
        HttpServletRequest request = (HttpServletRequest)req;
        //执行过滤器链（放行请求到下一个过滤器）
        chain.doFilter(new XssRequest(request), resp); 
    }

}

监听器使用

@WebListener
public class OnlineListener implements HttpSessionListener {

    private static int counter;

    @Override
    public void sessionCreated(HttpSessionEvent se) {
        //session被创建时执行
        System.out.println("session创建-->"+se.getSession().getId());
        counter++;
        //获取Servlet上下文（application）
        ServletContext application = se.getSession().getServletContext();
        application.setAttribute("counter",counter);
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent se) {
        //session被销毁时执行
        System.out.println("session销毁==>"+se.getSession().getId());
        counter--;
        ServletContext application = se.getSession().getServletContext();
        application.setAttribute("counter",counter);
    }
}