spring mvc enctype=multipart/form-data 参数过滤

最新推荐文章于 2024-06-30 18:38:41 发布

zhoucanji

最新推荐文章于 2024-06-30 18:38:41 发布

阅读量1k

点赞数 1

分类专栏： spring mvc 过滤文章标签：参数过滤 multipartform-data 过滤器 java

本文链接：https://blog.csdn.net/zhoucanji/article/details/79716066

版权

spring mvc 过滤专栏收录该内容

1 篇文章 0 订阅

订阅专栏

当表单的enctype=multipart/form-data时,一般的过滤器无法获取参数,所以

在springmvc配置文件注解适配器

把

org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter

改

com.zcj.MyAnnotationMethodHandlerAdapter,

这个类是继承spring的AnnotationMethodHandlerAdapter,重写ModelAndView handle(HttpServletRequest request,HttpServletResponse response, Object handler) 方法实现过滤.

package com.zcj;

import java.util.LinkedHashMap;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter;
public class MyAnnotationMethodHandlerAdapter extends
		AnnotationMethodHandlerAdapter {
	
	private static Map<String,String> xssMap = new LinkedHashMap<String,String>();
	{
		// 含有脚本： script
        xssMap.put("[s|S][c|C][r|R][i|C][p|P][t|T]", "");
        // 含有脚本 javascript
        xssMap.put("[\\\"\\\'][\\s]*[j|J][a|A][v|V][a|A][s|S][c|C][r|R][i|I][p|P][t|T]:(.*)[\\\"\\\']", "\"\"");
        // 含有函数： eval
        xssMap.put("[e|E][v|V][a|A][l|L]\\((.*)\\)", "");
	}
	
	/**
	 * 清除恶意的XSS脚本
	 * 
	 * @param value
	 * @return
	 */
	private String myCleanXSS(String value) {
		Set<String> keySet = xssMap.keySet();
		for (String key : keySet) {
			String v = xssMap.get(key);
			value = value.replaceAll(key, v);
		}
		return value;
	}
	private void myXss(HttpServletRequest request){
		Map map = request.getParameterMap();
		Set<String> keySet = map.keySet();
		for(String key : keySet){
			String[] values = request.getParameterValues(key);
			if(values!=null&&values.length>0){
				for(int i=0 ;i<values.length;i++){
					if(!StringUtils.isBlank(values[i])){
						values[i] = myCleanXSS(values[i]);
					}
				}
			}
		}
	}
	@Override
	public ModelAndView handle(HttpServletRequest request,
			HttpServletResponse response, Object handler) throws Exception {
		if("/article/addOrUpdateArticle".equals(request.getRequestURI())){
			myXss(request);
		}
		return super.handle(request, response, handler);
	}
}