Spring Filter過濾表單中的非法字符

使用Spring Filter過濾表單中的非法字符

package test.filter;

import java.io.IOException;
import java.util.Iterator;
import java.util.Map;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.BeanWrapper;
import org.springframework.beans.BeansException;
import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;

/**
 * 使用Spring過濾器來過濾請求中的非法字符<br>
 * 如果請求被重定向,則在被重定向的控制器方法執行前此過濾器也會執行
 * @author admin
 *
 */
public class CharacterFilter extends OncePerRequestFilter {
    
    // 如果使用CommonsMultipartResolver處理文件上傳,並且表單類型為multipart/form-data
    // 則此處需使用CommonsMultipartResolver,其參數設置應與配置文件中保持一致
    private CommonsMultipartResolver multipartResolver = null;
    
    /**
     * 過濾器加載時,initBeanWrapper(BeanWrapper)方法會在initFilterBean()方法之前加載<br>
     * 可以通過super.getFilterConfig().getInitParameter("param1")方法獲取在web.xml中配置的init-param參數
     */
    @Override
    protected void initBeanWrapper(BeanWrapper bw) throws BeansException {
        String param1 = super.getFilterConfig().getInitParameter("param1");
        System.out.println("param1:" + param1);
        
        super.initBeanWrapper(bw);
    }
    
    @Override
    protected void initFilterBean() throws ServletException {
        multipartResolver = new CommonsMultipartResolver();
        multipartResolver.setMaxInMemorySize(104857600);
        multipartResolver.setDefaultEncoding("utf-8");
        
        super.initFilterBean();
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        //此處可通過配置參數判斷是否需要過濾  ...
        
        HttpServletRequest httpRequest = (HttpServletRequest)request;
        // 此處使用httpRequest,直接使用request可能造成CharacterFilterRequestWrapper中request獲取不到值
        if(httpRequest.getContentType().toLowerCase().contains("multipart/form-data")){
            MultipartHttpServletRequest resolveMultipart = multipartResolver.resolveMultipart(httpRequest);
            filterChain.doFilter(new CharacterFilterRequestWrapper(resolveMultipart), response);
        }else{
            filterChain.doFilter(new CharacterFilterRequestWrapper(httpRequest), response);
        }
        
    }
    
    class CharacterFilterRequestWrapper extends HttpServletRequestWrapper {
        
        public CharacterFilterRequestWrapper(HttpServletRequest request) {
            super(request);
        }
        
        @Override
        public String getParameter(String name) {
            return super.getParameter(name);
        }
        
        @Override
        public String[] getParameterValues(String name) {
            return filterString(super.getParameterValues(name));
        }
        
        @Override
        public Map<String, String[]> getParameterMap() {
            Map<String, String[]> map = super.getParameterMap();
            if(map == null){
                return null;
            }
            
            Iterator<String> it = map.keySet().iterator();
            while(it.hasNext()){
                String param = it.next();
                String[] value = map.get(param);
                map.put(param, filterString(value));
            }
            
            return map;
        }
        
        private String filterString(String value){
            if(value == null){
                return null;
            }
            
            // 此處可根據需要選擇需要過濾的字符
            value = value.replaceAll("\r\n", "");
            value = value.replaceAll("\t", "     ");
            value = value.replaceAll(">", "&gt;");
            value = value.replaceAll("<", "&lt;");
            value = value.replaceAll("\"", "&quot;");
            
            return value;
        }
        
        private String[] filterString(String[] values){
            if(values == null){
                return null;
            }
            
            for (int i = 0; i < values.length; i++) {
                values[i] = filterString(values[i]);
            }
            
            return values;
        }
        
    }

}