Web过滤器总结

来源：互联网发布：网络语言的利与弊编辑：程序博客网时间：2024/05/29 23:25

1.过滤器代码

package com.ufgov.util;
​
import java.io.IOException;
​
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
​
/**
 *特殊字符过滤器
 *可以过滤xss和sql注入的关键字
 */
public class CharacterFilter implements Filter {
​
    public void destroy() {
    }
​
    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        TsRequest wrapRequest = new TsRequest(request,
                request.getParameterMap());
        chain.doFilter(wrapRequest, res);
    }
​
    public void init(FilterConfig arg0) throws ServletException {
    }
}

2.具体的实现

package com.ufgov.util;
​
import com.google.gson.JsonParseException;
import com.google.gson.JsonParser;
import com.ufgov.entity.SysRole;
import com.ufgov.entity.SysUserInfo;
import net.sf.json.JSONArray;
import net.sf.json.JSONObject;
import org.apache.commons.lang3.StringUtils;
​
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.*;
import java.lang.reflect.Method;
import java.nio.charset.Charset;
import java.util.*;
import java.util.Map.Entry;
​
/**
 *封装的请求处理特殊字符
 *配合过滤器处理特殊字符
 */
public class TsRequest extends HttpServletRequestWrapper {
​
    // 非法字符集  转成空
    private static String[] illegalArr = { "script", "alert", "expression", "iframe", "prompt", "\\\\u", "onerror",
            "onmousemove", "onafterprint", "onbeforeprint", "onbeforeunload", "onerror", "onhaschange", "onload",
            "onmessage", "onoffline", "ononline", "onpagehide", "onpageshow", "onpopstate", "onredo", "onresize",
            "onstorage", "onundo", "onunload", "onblur", "onchange", "oncontextmenu", "onfocus", "onformchange",
            "onforminput", "oninput", "oninvalid", "onreset", "onselect", "onsubmit", "onkeydown", "onkeypress",
            "onkeyup", "onclick", "ondblclick", "ondrag", "ondragend", "ondragenter", "ondragleave", "ondragover",
            "ondragstart", "ondrop", "onmousedown", "onmousemove", "onmouseout", "onmouseover", "onmouseup",
            "onmousewheel", "onscroll", "onabort", "oncanplay", "oncanplaythrough", "ondurationchange", "onemptied",
            "onended", "onerror", "onloadeddata", "onloadedmetadata", "onloadstart", "onpause", "onplay", "onplaying",
            "onprogress", "onratechange", "onreadystatechange", "onseeked", "onseeking", "onstalled", "onsuspend",
            "ontimeupdate", "onvolumechange", "onwaiting" };
    //html转义
    private static Map<String, String> illegalMap = new HashMap<String, String>() {
        {
            put("<", "&lt;");
            put(">", "&gt;");
            put("'", "&#39;");
            put("\"", "&quot;");
            put("/", "&#47;");
            put("\\\\", "&#92;");
            put("\\)", "）");//&#41;
            put("\\(", "（");//&#40;
            put(";", "&#59;");//&#59;
            put("\\[", "【");//&#91;
            put("\\]", "】");//&#92;
        }
    };
    private Map params;
    private final String bodyParam;
    public TsRequest(HttpServletRequest request, Map newParams) {
        super(request);
        this.params = newParams;
        String contentType = request.getContentType();
//      System.out.println(contentType);
        //不再过滤文件上传
        CharSequence cs = "multipart/form-data";
        if(contentType!=null && contentType.toLowerCase().contains(cs)){
            this.bodyParam = null;
        }else {
            this.bodyParam = getBodyString(request);
        }
    }
​
    /**
     * 从流中获取请求Body
     *
     * @param request
     * @return
     */
    private static String getBodyString(ServletRequest request) {
        StringBuilder sb = new StringBuilder();
        InputStream inputStream = null;
        BufferedReader reader = null;
        try {
            inputStream = request.getInputStream();
            reader = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
            String line;
            while ((line = reader.readLine()) != null) {
                sb.append(line);
            }
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            if (inputStream != null) {
                try {
                    inputStream.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (reader != null) {
                try {
                    reader.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        return sb.toString();
    }
    /**
     * getReader和getInputStream解决在parameter中无法获取参数的过滤
     * 
     * @return
     * @throws IOException
     */
    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }
​
    //排除前端的json字符串中,json用来处理json串的特殊字符.
    @Override
    public ServletInputStream getInputStream() throws IOException {
        if(bodyParam == null){
            return super.getInputStream();
        }
        String strCopy = bodyParam.trim();
        String newStr;
        char firstChar = strCopy.toCharArray()[0];
        if(firstChar == '{' && isGoodJson(strCopy)){//JsonObject
            JSONObject jsonObject = JSONObject.fromObject(strCopy);
//          jsonObject =
            jsonCheck(jsonObject);
            newStr = jsonObject.toString();
        }else if(firstChar == '[' && isGoodJson(strCopy)){//JsonArray
            JSONArray jsonArray = JSONArray.fromObject(strCopy);
            JSONArray tempArray = new JSONArray();
            for (int i = 0; i < jsonArray.size(); i++) {
                JSONObject jsonObject = (JSONObject)jsonArray.get(i);
                jsonCheck(jsonObject);
                tempArray.add(jsonObject);
            }
            newStr = tempArray.toString();
        }else{
            newStr = charFilter(bodyParam);
        }
        final ByteArrayInputStream bais = new ByteArrayInputStream(newStr.getBytes(Charset.forName("UTF-8")));
​
        return new ServletInputStream() {
            @Override
            public int read() throws IOException {
                return bais.read();
            }
        };
    }
​
    /**
     * 检查json中的值是否需要过滤.key值未判断
     * @param jsonObject
     */
    private void jsonCheck(JSONObject jsonObject){
//      JSONObject tempObj = new JSONObject();
        for (Object object : jsonObject.entrySet()) {
            Entry entry = (Entry)object;
            String key = (String)entry.getKey();
            Object obj = entry.getValue();
            if(obj instanceof String){
                String val = charFilter((String)obj);
                jsonObject.put(key,val);
            }else if(obj instanceof JSONObject){
//              jsonObject.put(key,jsonCheck((JSONObject)obj));
                jsonCheck((JSONObject)obj);
                jsonObject.put(key,obj);
            }else if(obj instanceof JSONArray){
                JSONArray arr = (JSONArray)obj;
                JSONArray tempArr = new JSONArray();
                for (int i = 0; i < arr.size(); i++) {
                    Object tempObj = arr.get(i);
                    if(tempObj instanceof JSONObject){
                        jsonCheck((JSONObject)tempObj);
                        tempArr.add(tempObj);
                    }else if(tempObj instanceof String){
                        tempArr.add(charFilter((String) tempObj));
                    }else {
                        System.out.println("未知的数据类型:"+tempObj.toString());
                    }
                }
                jsonObject.put(key,tempArr);
            }
        }
//      return  tempObj;
    }
​
    // getParameter开头的方法,过滤的是在parameter中存在的数据
    public Map getParameterMap() {
        return params;
    }
​
    public Enumeration getParameterNames() {
        @SuppressWarnings("unchecked")
        Vector l = new Vector(params.keySet());
        return l.elements();
    }
​
    /**
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
     * getHeaderNames 也可能需要覆盖
     */
    // @Override
    // public String getHeader(String name) {
    // String value = super.getHeader(charFilter(name));
    // if (value != null) {
    // value = charFilter(value);
    // }
    // return value;
    // }
​
    public String[] getParameterValues(String name) {
        Object v = params.get(name);
        if (v == null) {
            return null;
        } else if (v instanceof String[]) {
            String[] value = (String[]) v;
            for (int i = 0; i < value.length; i++) {
                value[i] = this.charFilter(value[i]);
            }
            return value;
        } else if (v instanceof String) {
            String value = (String) v;
            value = this.charFilter(value);
            return new String[] { value };
        } else {
            return new String[] { v.toString() };
        }
    }
​
    public String getParameter(String name) {
        Object v = params.get(name);
        if (v == null) {
            return null;
        } else if (v instanceof String[]) {
            String[] strArr = (String[]) v;
            if (strArr.length > 0) {
                String value = strArr[0];
                value = this.charFilter(value);
                return value;
            } else {
                return null;
            }
        } else if (v instanceof String) {
            String value = (String) v;
            value = this.charFilter(value);
            return value;
        } else {
            return v.toString();
        }
    }
    private static boolean isGoodJson(String json) {
        if (StringUtils.isBlank(json)) {
            return false;
        }
        try {
            new JsonParser().parse(json);
            return true;
        } catch (JsonParseException e) {
            return false;
        }
    }
    /**
     * 字符串遍历过滤
     * 
     * @param value
     * @return
     */
    private String charFilter(String value) {
        // 过滤script等 转成空
        for (String str : illegalArr) {
            value = value.replaceAll("(?i)" + str, ""); // (?i)忽略大小写
        }
        // 过滤<等
        for (Entry<String, String> entry : illegalMap.entrySet()) {
            value = value.replaceAll(entry.getKey(), entry.getValue());// 转义非法字符
        }
​
        // 过滤\r\n,解决HTTP响应拆分漏洞
        value = value.replaceAll("\r\n", "");
        return value;
    }
​
    public static Map<String, String> getParamMap(HttpServletRequest request) {
        return getParamMap(request.getParameterMap());
    }
​
    public static Map<String, String> getParamMap(Map<String, String[]> requestMap) {
        Map<String, String> paramMap = new HashMap<String, String>();
        for (Entry<String, String[]> entry: requestMap.entrySet()) {
            if (entry.getValue().length == 1) {
                paramMap.put(entry.getKey(), entry.getValue()[0]);
            } else {
                String[] values = entry.getValue();
                String value = "";
                for (int i = 0; i < values.length; i++) {
                    value += values[i] + ",";
                }
                value = value.substring(0, value.length() - 1);
                paramMap.put(entry.getKey(), value);
            }
        }
        return paramMap;
    }
​
    /**
     * 将实体直接设置在RequestAttribute中,前端使用${属性名}来获取
     * 
     * @author Lihhz
     * @param request
     * @param entity
     */
    public static <T> void saveToRequestAttribute(HttpServletRequest request, T entity) {
        try {
            if (entity == null)
                return;
            if (entity instanceof Map) {
                @SuppressWarnings("rawtypes")
                Map map = (Map) entity;
                for (Object key : map.keySet())
                    request.setAttribute(key.toString(), map.get(key));
                return;
            }
            Method[] MethodArr = entity.getClass().getDeclaredMethods();
            StringBuffer sbStr = new StringBuffer(50);
            for (Method method : MethodArr)
                if (method.getModifiers() == 1) {
                    sbStr.append(method.getName());
                    if (sbStr.indexOf("get") == 0) {
                        sbStr.delete(0, 3).setCharAt(0, (char) (sbStr.charAt(0) + ' '));
                        Object value = method.invoke(entity, new Object[0]);
                        request.setAttribute(sbStr.toString(), value);
                    }
                    sbStr.delete(0, sbStr.length());
                }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

3.总结

a 目前我知道的后端获取数据方式有：1，request的getParameter及类似系列数据；2，request的getInputStream方法，这个主要是读取数据流的

b spring在controller中的参数注入使用的应该是request的getInputStream

c request的数据流及参数一经读取就不再存在，所以在后续的controller中是无法获取的。为了避免这个问题，就需要继承HttpServletRequestWrapper，并重写其中的getParameter系列和getInputStream、getReader

阅读全文

0 0