封装HashMap加入URLdecoder解码器，防注入

其中URLDecoder.decode有个好处，就是防止%sql注入，当然对其他字符无效了，当在input输入用户名时候‘10001%’，经过后台先获取，并解码，会报错：

package test;

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;

public class Test1 {

	public static void main(String[] arg0) {
		String target = "1001%";
		String charset = "UTF-8";
		try {
			/*
			 * System.out.println("---------URLDecoder处理前：--------" + target +
			 * "--->处理后===" + URLEncoder.encode(target, charset));
			 */
			System.out.println("---------URLDecoder处理前：--------" + target
					+ "--->处理后===" + URLDecoder.decode(target, charset));
		} catch (UnsupportedEncodingException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}

	}
}

报错如下：

Exception in thread "main" java.lang.IllegalArgumentException: URLDecoder: Incomplete trailing escape (%) pattern
	at java.net.URLDecoder.decode(URLDecoder.java:187)
	at test.Test1.main(Test1.java:17)

项目中用的是springMVC进行异常处理：

<bean id="exceptionResolver" class="com.ailk.base.exception.CustomSimpleMappingExceptionResolver">  
	    <!-- 定义默认的异常处理页面，当该异常类型的注册时使用 -->  
	    <property name="defaultErrorView" value="error/failure"></property>  
	    <!-- 定义需要特殊处理的异常，用类名或完全路径名作为key，异常页名作为值 -->  
	    <property name="exceptionMappings">  
	        <props>  
	            <prop key="com.ailk.base.exception.SystemException">/error/500</prop>
	            <prop key="com.ailk.base.exception.BusinessException">/error/error</prop>
	            <prop key="java.lang.exception">error/500</prop> 
	        </props>  
	    </property>  
	</bean> 

package com.ailk.base.exception;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.SimpleMappingExceptionResolver;

public class CustomSimpleMappingExceptionResolver extends
		SimpleMappingExceptionResolver {

	@Override
	protected ModelAndView doResolveException(HttpServletRequest request,
			HttpServletResponse response, Object handler, Exception ex) {
		// Expose ModelAndView for chosen error view.
		String viewName = determineViewName(ex, request);
		if (viewName != null) {// JSP格式返回
			System.out.println("------------------------------>>>1 " + (request.getHeader("accept").indexOf("application/json") > -1));
			System.out.println("------------------------------>>>2 " + (request
					.getHeader("X-Requested-With") != null && request
					.getHeader("X-Requested-With").indexOf("XMLHttpRequest") > -1));
			if (!(request.getHeader("accept").indexOf("application/json") > -1 || (request
					.getHeader("X-Requested-With") != null && request
					.getHeader("X-Requested-With").indexOf("XMLHttpRequest") > -1))) {
				// 如果不是异步请求
				// Apply HTTP status code for error views, if specified.
				// Only apply it if we're processing a top-level request.
				Integer statusCode = determineStatusCode(request, viewName);
				if (statusCode != null) {
					applyStatusCodeIfPossible(request, response, statusCode);
				}
				return getModelAndView(viewName, ex, request);
			} else {// JSON格式返回
				try {
					System.out.println("------------------------------>>>enter into json " + ex.getMessage());
					PrintWriter writer = response.getWriter();
					System.out.println("------------------------------>>> " + ex.getMessage());
					writer.write(ex.getMessage());
					writer.flush();
				} catch (IOException e) {
					System.out.println("------------------------------>>> <<<--------------------------");
					e.printStackTrace();
				}
				return null;

			}
		} else {
			return null;
		}
	}
}

所以，有效的解决了sql注入。网上还有的方法更直接，就是过滤器过滤直接粘过来：

配置拦截器

<!‐‐ 拦截器配置‐‐>
<mvc:interceptors>
<!‐‐ SQL注入拦截‐‐>
<mvc:interceptor>
<mvc:mapping path="/**"/>
<bean class="com.data.job.util.interceptor.SqlInjectInterceptor"></bean>
</mvc:interceptor>
</mvc:interceptors>

/**
* 防止SQL注入的拦截器
*
* @author tyee.noprom@qq.com
* @time 2/13/16 8:22 PM.
*/
public class SqlInjectInterceptor implements HandlerInterceptor {
public boolean preHandle(HttpServletRequest request, HttpServletResponse response
Enumeration<String> names = request.getParameterNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
String[] values = request.getParameterValues(name);
for (String value : values) {
value = clearXss(value);
}
}

/**
* 处理字符转义
*
* @param value
* @return
*/
private String clearXss(String value) {
if (value == null || "".equals(value)) {
return value;
}
value = value.replaceAll("<", "<").replaceAll(">", ">");
value = value.replaceAll("\\(", "(").replace("\\)", ")");
value = value.replaceAll("'", "'");
value = value.replaceAll("eval\\((.*)\\)", "");
value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",
"\"\"");
value = value.replace("script", "");
return value;
}

黄金分割线

===================================================================================================================

自己项目的代码

@ResponseBody
	@RequestMapping(value = "login.htm")
	public Map<String, Object> login(HttpServletRequest request, HttpServletResponse response) {
		boolean result = false;
		IMap _staffMap = new IMap();
		IMap params = new IMap(request);

IMap封装了HashMap，以下封装代码：

// 从页面获取数据
	public IMap(HttpServletRequest request) {
		this.request = request;
		// 返回值Map
		returnMap = new HashMap<String, Object>();
		// 参数Map
		//@SuppressWarnings("unchecked")
		@SuppressWarnings("unchecked")
		Map<String, String[]> properties = request.getParameterMap();
		Set<Map.Entry<String, String[]>> entrySet = properties.entrySet();
		for (Map.Entry<String, String[]> entry : entrySet) {
			String key = (String) entry.getKey() == null ? null : convert2Decode((String) entry.getKey(), charset);
			Object valueObj = entry.getValue();
			String value = "";
			if(null == valueObj){
				value = "";
			}else if(valueObj instanceof String[]){
				String[] values = (String[])valueObj;
				for(int i=0;i<values.length;i++){
					value = values[i].trim();
					if (request.getMethod().equalsIgnoreCase("get")) {
						value = values == null ? null : convert2Character(value, charset);
					}
					value = values == null ? null : convert2Decode(value, charset) + ",";
				}
				value = value.substring(0, value.length()-1);
			}else{
				value = valueObj.toString();
			}
			returnMap.put(key, value);
		}
	}

private static String convert2Decode(String target, String charset){
		try {
			System.out.println("---------URLDecoder处理前：--------" + target +"--->处理后===" + URLDecoder.decode(target, charset));
			return URLDecoder.decode(target, charset);
		} catch (UnsupportedEncodingException e) {
			return target;
		}
	}
	
	public String convert2Character(String target, String charset) {
        System.out.println("编码转换之前：" + target);
        try {
            return new String(target.trim().getBytes("ISO-8859-1"), charset);
        } catch (UnsupportedEncodingException e) {
        	e.printStackTrace();
            return target;
        }
    }