filter的使用处理URL白名单和参数白名单(用于安全红线扫描)

为什么80%的码农都做不了架构师？>>>   

package com.huawei.filters;

import java.io.IOException;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Vector;
import java.util.regex.Pattern;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class RequestActionFilter implements Filter
{

    private String OptionalCharEncode;

    private String isDebug;

    private String whiteUriList[];

    private String whiteParams[];

    public RequestActionFilter()
    {
        OptionalCharEncode = null;
        isDebug = "1";
        whiteUriList = null;
        whiteParams = null;
    }

    public void init(FilterConfig filterConfig) throws ServletException
    {
        OptionalCharEncode = filterConfig
                .getInitParameter("OptionalCharEncode");
        isDebug = filterConfig.getInitParameter("isDebug");
        if (isDebug == null || "".equals(isDebug))
        {
            isDebug = "1";
        }
        if (OptionalCharEncode == null)
        {
            OptionalCharEncode = "";
        }
        whiteUriList = filterConfig.getInitParameter("whiteUriList").split("@");
        whiteParams = filterConfig.getInitParameter("whiteParams").split("@");
    }

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException
    {
        HttpServletRequest req = (HttpServletRequest) request;
        String freeUriPattern = ".*\\.(js|css|gif|jpg|ico|png)$";
        if (Pattern.matches(freeUriPattern, req.getRequestURI()))
        {
            chain.doFilter(request, response);
            return;
        }
        if ("0".equals(isDebug))
        {
            System.out.println("--------RequestURI:" + req.getRequestURI());
        }
        if (IsWhiteUri(req.getRequestURI()))
        {
            if ("0".equals(isDebug))
            {
                System.out.println("--------" + req.getRequestURI()
                        + " is whiteUri");
            }
            chain.doFilter(request, response);
            return;
        }
        HashMap paramMap = new HashMap(req.getParameterMap());
        processParamsters(paramMap);
        if ("0".equals(isDebug))
        {
            Vector vec = new Vector(paramMap.keySet());
            Enumeration keys = vec.elements();
            String key = "";
            String values[] = (String[]) null;
            while (keys.hasMoreElements())
            {
                Object obj = keys.nextElement();
                if (obj != null)
                {
                    key = (String) obj;
                    values = (String[]) paramMap.get(key);
                    for (int i = 0; i < values.length; i++)
                    {
                        System.out.println("------convert_after_paramname:"
                                + key + "-----convert_after_paramvalue:"
                                + values[i]);
                    }

                }
            }
        }
        chain.doFilter(request, response);
    }

    private boolean IsWhiteUri(String uri)
    {
        for (int i = 0; i < whiteUriList.length; i++)
        {
            if (whiteUriList[i].length() > 0)
            {
                String whiteuri = whiteUriList[i];
                whiteuri = whiteuri.trim();
                Pattern p = Pattern.compile(whiteuri);
                if (p.matcher(uri).find())
                {
                    return true;
                }
            }
        }

        return false;
    }

    private boolean IsWhiteParam(String param)
    {
        for (int i = 0; i < whiteParams.length; i++)
        {
            String whiteparam = whiteParams[i];
            whiteparam = whiteparam.trim();
            if (whiteparam.equals(param))
            {
                return true;
            }
        }

        return false;
    }

    private void processParamsters(HashMap params)
    {
        Vector l = new Vector(params.keySet());
        Enumeration keys = l.elements();
        String key = "";
        String values[] = (String[]) null;
        int len = 0;
        while (keys.hasMoreElements())
        {
            Object obj = keys.nextElement();
            if (obj != null)
            {
                key = (String) obj;
                if (!IsWhiteParam(key))
                {
                    values = (String[]) params.get(key);
                    len = values.length;
                    for (int i = 0; i < len; i++)
                    {
                        if ("0".equals(isDebug))
                        {
                            System.out.println("------convert_per_paramname:"
                                    + key + "-----convert_per_paramvalue:"
                                    + values[i]);
                        }
                        values[i] = values[i].replaceAll("&", "&amp;");
                        values[i] = values[i].replaceAll("<", "&lt;");
                        values[i] = values[i].replaceAll(">", "&gt;");
                        values[i] = values[i].replaceAll("\"", "&quot;");
                        values[i] = values[i].replaceAll("'", "&#39;");
                        if (OptionalCharEncode.equalsIgnoreCase("true"))
                        {
                            values[i] = values[i].replaceAll("/", "&#47;");
                            values[i] = values[i].replaceAll("\\(", "&#40;");
                            values[i] = values[i].replaceAll("\\)", "&#41;");
                        }
                    }

                }
            }
        }
    }

    public void destroy()
    {
    }
}

 

 

<filter>
 <filter-name>urlFilter</filter-name>
 <filter-class>com.huawei.filters.RequestActionFilter</filter-class>
  <init-param>
  <param-name>isDebug</param-name>
  <param-value>0</param-value>
 </init-param>
 <init-param>
  <param-name>OptionalCharEncode</param-name>
  <param-value>true</param-value>
 </init-param>
 <init-param>
      <param-name>whiteUriList</param-name>
      <param-value></param-value>
    </init-param>
    <init-param>
      <param-name>whiteParams</param-name>
      <param-value>pswd@validateCode@URL</param-value>
    </init-param>
</filter>
<filter-mapping>
 <filter-name>urlFilter</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>

转载于:https://my.oschina.net/exit/blog/164478