SpringBoot 之 SpringMVC 实现SQL注入过滤 完整版（支持POST请求和GET请求）

首先请参考：SpringBoot 之 SpringMVC拦截器从Request中获取参数并解决request的请求流只能读取一次的问题

参考完上面的代码，现在开始编辑SQL注入拦截器，核心功能代码如下：

package com.digipower.erms.interceptor;

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.util.ArrayList;
import java.util.Date;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringEscapeUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import com.alibaba.druid.util.StringUtils;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.ctc.wstx.util.StringUtil;
import com.digipower.erms.annotation.SysLog;
import com.digipower.erms.api.LogRecordService;
import com.digipower.erms.common.cache.RedisUtil;
import com.digipower.erms.common.model.Result;
import com.digipower.erms.domain.LogRecord;
import com.digipower.erms.request.wrapper.SQLInjectionHttpServletRequestWrapper;
import com.digipower.erms.util.HttpContextUtils;
import com.digipower.erms.util.HttpUtils;
import com.digipower.erms.util.SecurityUtils;

/**
 * 全局拦截器
 */
public class ErmsInterceptor extends HandlerInterceptorAdapter {

    private static final Logger log = LoggerFactory.getLogger(ErmsInterceptor.class);
    
    @Autowired
	private LogRecordService service;
    
    @Autowired
	SecurityUtils securityUtils;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    	log.debug("ErmsInterceptor start pre ...");
    	String method = request.getMethod();
    	if("POST".equals(method)){
    		SQLInjectionHttpServletRequestWrapper wrapper = new SQLInjectionHttpServletRequestWrapper(request);
    		String requestBody = wrapper.getRequestBodyParame();
    		if(!StringUtils.isEmpty(requestBody)){
    			//sql注入直接拦截
				if(sqlInject(requestBody.toLowerCase())){ 
					 // 补全拦截器过滤用户登入信息
					 if (handler instanceof HandlerMethod) {
						 HandlerMethod h = (HandlerMethod) handler;
						 insertLogRecord(h,requestBody); 
					 }
					response.setContentType("text/html;charset=UTF-8");  
					response.getWriter().print(JSON.toJSONString(Result.ok("-3","请求异常").setData("error-message", "参数含有非法攻击字符,已禁止继续访问")));  
					return false;  
				}
    		}  
    	} else {
    		Enumeration<String> names = request.getParameterNames(); 
    		// 请求参数转换JSON 对象
			List<Map> container = new ArrayList<Map>();
			while(names.hasMoreElements()){
				Map<String,String> map = new HashMap<String,String>();
				String key = names.nextElement();
				String value = request.getParameter(key);
				map.put(key, value);
				container.add(map);
			}
			String requestBody = JSON.toJSONString(container);
			
    		while(names.hasMoreElements()){  
    			String name = names.nextElement();  
    			String[] values = request.getParameterValues(name);  
    			for(String value: values){
    				//sql注入直接拦截
    				if(sqlInject(value.toLowerCase())){
    					 // 补全拦截器过滤用户登入信息
    					if(handler instanceof HandlerMethod){
    						HandlerMethod h = (HandlerMethod) handler;
    						insertLogRecord(h,requestBody); 
    					}
    					
    					response.setContentType("text/html;charset=UTF-8");  
    					response.getWriter().print(JSON.toJSONString(Result.ok("-3","请求异常").setData("error-message", "参数含有非法攻击字符,已禁止继续访问")));  
    					return false;  
    				}
    				// 脚本注入XSS
    				StringEscapeUtils.escapeHtml(value);
    				StringEscapeUtils.escapeHtml(value);
    			}  
    		}  
    	}

        //TODO 
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        super.postHandle(request, response, handler, modelAndView);
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        super.afterCompletion(request, response, handler, ex);
    }

    @Override
    public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        super.afterConcurrentHandlingStarted(request, response, handler);
    }
    
    /**
     * 
     * @Title: sqlInject   
     * @Description: TODO SQL 注入正在表达式(sql 函数关键字过滤)
     * @param: @param value
     * @param: @return      
     * @return: boolean      
     * @throws
     */
    public boolean sqlInject(String value){  
        if(value == null || "".equals(value)){  
            return false;  
        }  
        String regex =".*(select|update|union|and|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|drop|execute|[+]|%).*";
        boolean isMatch = Pattern.matches(regex, value);
        return isMatch;  
    }
    
    public void insertLogRecord(HandlerMethod handlerMethod,String queryParame){
    	LogRecord record = new LogRecord();
    	SysLog sysLog = handlerMethod.getMethodAnnotation(SysLog.class);
    	if (sysLog != null) {
            // 注解上的描述
        	record.setLogType(Short.valueOf("-1"));
        	record.setLogDesc(sysLog.value());
        }
    	String className = handlerMethod.getClass().getName();
        String methodName = handlerMethod.getMethod().getName();
    	record.setClassMethod(className + "." + methodName + "()");
    	// 请求参数
    	record.setParames(queryParame);
    	// 请求地址
        HttpServletRequest request = HttpContextUtils.getRequest();
        String ip = HttpUtils.getIpAddress(request);
        record.setIpAddress(ip);
        
        // 操作用户
       String username = securityUtils.getAuthUserPin(request);
       record.setUsername(username);
       
       // 创建时间
       record.setCreateTime(new Date()); 
       service.insert(record);
    }
}

springboot 配置拦截器:

package com.digipower.ucas.config;
 
import java.util.ArrayList;
import java.util.List;
 
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
 
import io.swagger.annotations.ApiOperation;
import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.ParameterBuilder;
import springfox.documentation.builders.PathSelectors;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.schema.ModelRef;
import springfox.documentation.service.ApiInfo;
import springfox.documentation.service.Contact;
import springfox.documentation.service.Parameter;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spring.web.plugins.Docket;
import springfox.documentation.swagger2.annotations.EnableSwagger2;
 
@Configuration
@EnableSwagger2
@EnableWebMvc
public class SwaggerConfig extends WebMvcConfigurerAdapter {
 
	@Override
	public void addResourceHandlers(ResourceHandlerRegistry registry) {
		registry.addResourceHandler("swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
		registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
	}
	
	// 定义json 转换器
	@Override
	public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
		// TODO Auto-generated method stub
		super.configureMessageConverters(converters);
	}
 
	@Bean
	public Docket buildDocket() {
 
		ParameterBuilder tokenPar = new ParameterBuilder();
		List<Parameter> pars = new ArrayList<Parameter>();
		tokenPar.name("X-CSRF-TOKEN").description("令牌").modelRef(new ModelRef("string")).parameterType("header")
				.required(false).build();
		pars.add(tokenPar.build());
 
		return new Docket(DocumentationType.SWAGGER_2).select()
				.apis(RequestHandlerSelectors.withMethodAnnotation(ApiOperation.class)).paths(PathSelectors.any())
				.build().globalOperationParameters(pars).apiInfo(buildApiInf());
	}
 
	
 
	private ApiInfo buildApiInf() {
		return new ApiInfoBuilder().title("深圳市世纪伟图科技开发有限公司 - 城建档案系统").termsOfServiceUrl("http://www.digipower.cn/")
				.description("API接口")
				.contact(new Contact("digipower", "http://www.digipower.cn/", "digiservices@digipower.com"))
				.version("2.0").build();
 
	}
	
	    //SQL注入拦截器
		@Bean
		public ErmsInterceptor sqlInjectInterceptor () {
			return new ErmsInterceptor ();
		}
	 
		@Override
		public void addInterceptors(InterceptorRegistry registry) {// 2
			registry.addInterceptor(sqlInjectInterceptor());
		}
}