java struct2拦截器_Java struts2 拦截器 interceptors

拦截器类如下所示：

import java.io.PrintWriter;

import java.util.ArrayList;

import java.util.HashMap;

import java.util.Iterator;

import java.util.List;

import java.util.Map;

import java.util.Map.Entry;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;

import org.apache.struts2.ServletActionContext;

import com.edp.org.user.vo.User;

import com.opensymphony.xwork2.ActionContext;

import com.opensymphony.xwork2.ActionInvocation;

import com.opensymphony.xwork2.ActionSupport;

import com.opensymphony.xwork2.interceptor.AbstractInterceptor;

/**

* 特殊字符拦截器

*

* @author zhangda

*

*/

public class SpecialCharInterceptor extends AbstractInterceptor {

Logger logger = Logger.getLogger(this.getClass());

/**

* 拦截方法

*

*/

public String intercept(ActionInvocation invocation) throws Exception {

// 取得ActionContext实例

ActionContext ctx = invocation.getInvocationContext();

//先验证是否传入非法字符，以防sql注入 --张达 20151216

String msg = validateDataBaseSpecialChar(ctx);

if(!msg.equals("")){

logger.error("参数传入非法字符！");

HttpServletResponse response = ServletActionContext.getResponse();

response.setHeader("Content-type", "text/html;charset=UTF-8");

response.setCharacterEncoding("utf-8");

PrintWriter out = response.getWriter();

out.print("{\"success\": false, \"errMsg\": \"参数传入非法字符\"}");

out.flush();

out.close();

return ActionSupport.ERROR;

}else{

return invocation.invoke();

}

}

/***

* 过滤sql注入的特殊字符 zd

* @param ac

* @return

*/

public String validateDataBaseSpecialChar(ActionContext ac) {

Map inputMap = ac.getParameters();

//查询字典请求需要传入特殊字符

if(ac.getContext().getName().equals("getDictionaryByTypeIds")){

return "";

}else{

Iterator> it = inputMap.entrySet().iterator();

while (it.hasNext()) {

Map.Entry entry = it.next();

Object value = entry.getValue();

if (value instanceof String[]) {

String[] valueArray = (String[])value;

String valueStr = "";

if(valueArray != null && valueArray.length != 0){

for(int i=0; i

valueStr += valueArray[0] + ",";

}

}

return checkInject(valueStr);

}

}

}

return "";

}

//防sql注入的字符串数组

private static final String[] INJ_STR = {

"exec ", "select ", "insert ", "update " , "delete", "count ", "master ", "drop ",

"truncate ", "declare ", " or ", " and ", "--", "'", "\"", "\'", "\\\"", "(", ")", ";", "--", "+"

};

private static String checkInject(String str) {

for (int i=0; i

if (str.toLowerCase().indexOf(INJ_STR[i]) > -1) {

return "error";

}

}

return "";

}

}

struts配置文件如下：