Compare commits
No commits in common. 'e948e54a48db377a90a819027700cb135fb6b245' and 'c79e3958bacada735bf89e5974985c58f643c8a7' have entirely different histories.
e948e54a48
...
c79e3958ba
@ -1,118 +1,101 @@
|
|||||||
//package com.fuint.common.filter;
|
package com.fuint.common.filter;
|
||||||
//
|
|
||||||
//
|
|
||||||
//import cn.hutool.core.util.ObjectUtil;
|
import cn.hutool.core.util.ObjectUtil;
|
||||||
//import com.alibaba.fastjson2.JSONObject;
|
import com.alibaba.fastjson2.JSONObject;
|
||||||
//import com.fasterxml.jackson.databind.ObjectMapper;
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
||||||
//import com.fuint.framework.exception.BusinessRuntimeException;
|
import com.fuint.framework.exception.BusinessRuntimeException;
|
||||||
//import org.apache.commons.lang3.StringUtils;
|
import org.apache.commons.lang3.StringUtils;
|
||||||
//import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.web.multipart.support.StandardServletMultipartResolver;
|
||||||
//import org.springframework.beans.factory.annotation.Qualifier;
|
|
||||||
//import org.springframework.stereotype.Component;
|
import javax.servlet.*;
|
||||||
//import org.springframework.web.multipart.support.StandardServletMultipartResolver;
|
import javax.servlet.annotation.WebFilter;
|
||||||
//import org.springframework.web.servlet.HandlerExceptionResolver;
|
import javax.servlet.http.HttpServletRequest;
|
||||||
//
|
import javax.servlet.http.HttpServletResponse;
|
||||||
//import javax.servlet.*;
|
import java.io.BufferedReader;
|
||||||
//import javax.servlet.annotation.WebFilter;
|
import java.io.IOException;
|
||||||
//import javax.servlet.http.HttpServletRequest;
|
import java.util.Map;
|
||||||
//import javax.servlet.http.HttpServletResponse;
|
import java.util.Set;
|
||||||
//import java.io.BufferedReader;
|
import java.util.TreeMap;
|
||||||
//import java.io.IOException;
|
import java.util.stream.Collectors;
|
||||||
//import java.util.Map;
|
|
||||||
//import java.util.Set;
|
|
||||||
//import java.util.TreeMap;
|
@WebFilter(filterName = "CharsetFilter",urlPatterns = "/*")
|
||||||
//import java.util.stream.Collectors;
|
public class SpecialCharFilter implements Filter {
|
||||||
//
|
|
||||||
//
|
private static final String SQL_REGX = "[\\\\^$*+?{}()=&;%+\\[\\].|]";
|
||||||
//@WebFilter(filterName = "CharsetFilter", urlPatterns = "/*")
|
|
||||||
//@Component
|
@Override
|
||||||
//public class SpecialCharFilter implements Filter {
|
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException, IOException {
|
||||||
//
|
HttpServletRequest req = (HttpServletRequest) servletRequest;
|
||||||
// private static final String SQL_REGX = "[=]";
|
|
||||||
// @Qualifier("handlerExceptionResolver")
|
// 防止流读取一次后就没有了, 所以需要将流继续写出去
|
||||||
// @Autowired
|
MyRequestWrapper requestWrapper = new MyRequestWrapper(req);
|
||||||
// private HandlerExceptionResolver resolver;
|
|
||||||
//
|
// 获取请求参数
|
||||||
// @Override
|
Map<String, Object> paramsMaps = new TreeMap<>();
|
||||||
// public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException, IOException {
|
if ("POST".equals(req.getMethod().toUpperCase())) {
|
||||||
// HttpServletRequest req = (HttpServletRequest) servletRequest;
|
String body = requestWrapper.getBody();
|
||||||
// String servletPath = req.getServletPath();
|
paramsMaps = JSONObject.parseObject(body, TreeMap.class);
|
||||||
// HttpServletResponse rep = (HttpServletResponse) servletResponse;
|
} else {
|
||||||
// MyRequestWrapper requestWrapper = new MyRequestWrapper(req);
|
Map<String, String[]> parameterMap = requestWrapper.getParameterMap();
|
||||||
// if (ObjectUtil.notEqual(servletPath,"/backendApi/login/doLogin")){
|
Set<Map.Entry<String, String[]>> entries = parameterMap.entrySet();
|
||||||
// // 防止流读取一次后就没有了, 所以需要将流继续写出去
|
for (Map.Entry<String, String[]> next : entries) {
|
||||||
//
|
paramsMaps.put(next.getKey(), next.getValue()[0]);
|
||||||
// // 获取请求参数
|
}
|
||||||
// Map<String, Object> paramsMaps = new TreeMap<>();
|
}
|
||||||
// if ("POST".equals(req.getMethod().toUpperCase())) {
|
|
||||||
// String body = requestWrapper.getBody();
|
// 校验SQL注入
|
||||||
// paramsMaps = JSONObject.parseObject(body, TreeMap.class);
|
if (ObjectUtil.isNotEmpty(paramsMaps)) {
|
||||||
// } else {
|
for (Object o : paramsMaps.entrySet()) {
|
||||||
// Map<String, String[]> parameterMap = requestWrapper.getParameterMap();
|
Map.Entry entry = (Map.Entry) o;
|
||||||
// Set<Map.Entry<String, String[]>> entries = parameterMap.entrySet();
|
Object value = entry.getValue();
|
||||||
// for (Map.Entry<String, String[]> next : entries) {
|
if (value != null) {
|
||||||
// paramsMaps.put(next.getKey(), next.getValue()[0]);
|
boolean isValid = checkSqlInject(value.toString(), servletResponse);
|
||||||
// }
|
if (!isValid) {
|
||||||
// }
|
return;
|
||||||
//
|
}
|
||||||
// // 校验SQL注入
|
}
|
||||||
// if (ObjectUtil.isNotEmpty(paramsMaps)) {
|
}
|
||||||
// for (Object o : paramsMaps.entrySet()) {
|
}
|
||||||
// Map.Entry entry = (Map.Entry) o;
|
|
||||||
// Object value = entry.getValue();
|
chain.doFilter(requestWrapper, servletResponse);
|
||||||
// if (value != null) {
|
|
||||||
//
|
|
||||||
// boolean isValid = checkSqlInject(value.toString(), servletResponse);
|
}
|
||||||
// if (!isValid) {
|
|
||||||
// resolver.resolveException(req, rep,
|
//获取request请求body中参数
|
||||||
// null, FileterException("客户端信息非法！！,存在特殊字符请重新输入"));
|
public static String getBodyString(BufferedReader br) {
|
||||||
// return;
|
String inputLine;
|
||||||
// }
|
String str = "";
|
||||||
// }
|
try {
|
||||||
// }
|
while ((inputLine = br.readLine()) != null) {
|
||||||
// }
|
str += inputLine;
|
||||||
// }
|
}
|
||||||
//
|
br.close();
|
||||||
// chain.doFilter(requestWrapper, servletResponse);
|
} catch (IOException e) {
|
||||||
//
|
System.out.println("IOException: " + e);
|
||||||
//
|
}
|
||||||
// }
|
return str;
|
||||||
//
|
}
|
||||||
// //获取request请求body中参数
|
|
||||||
// public static String getBodyString(BufferedReader br) {
|
/**
|
||||||
// String inputLine;
|
* 检查SQL注入
|
||||||
// String str = "";
|
*
|
||||||
// try {
|
* @param value 参数值
|
||||||
// while ((inputLine = br.readLine()) != null) {
|
* @param servletResponse 相应实例
|
||||||
// str += inputLine;
|
* @throws IOException IO异常
|
||||||
// }
|
*/
|
||||||
// br.close();
|
private boolean checkSqlInject(String value, ServletResponse servletResponse) throws IOException {
|
||||||
// } catch (IOException e) {
|
if (null != value) {
|
||||||
// System.out.println("IOException: " + e);
|
String output = value.replaceAll(SQL_REGX, "");
|
||||||
// }
|
if (output.length()<value.length()) {
|
||||||
// return str;
|
return false;
|
||||||
// }
|
}
|
||||||
//
|
}
|
||||||
// /**
|
return true;
|
||||||
// * 检查SQL注入
|
}
|
||||||
// *
|
|
||||||
// * @param value 参数值
|
|
||||||
// * @param servletResponse 相应实例
|
|
||||||
// * @throws IOException IO异常
|
}
|
||||||
// */
|
|
||||||
// private boolean checkSqlInject(String value, ServletResponse servletResponse) throws IOException {
|
|
||||||
// if (null != value) {
|
|
||||||
// String output = value.replaceAll(SQL_REGX, "");
|
|
||||||
// if (output.length() < value.length()) {
|
|
||||||
// return false;
|
|
||||||
// }
|
|
||||||
// }
|
|
||||||
// return true;
|
|
||||||
// }
|
|
||||||
//
|
|
||||||
// public Exception FileterException(String cause) {
|
|
||||||
// return new Exception(cause);
|
|
||||||
// }
|
|
||||||
//
|
|
||||||
//
|
|
||||||
//}
|
|
||||||
@ -1,23 +0,0 @@
|
|||||||
package com.fuint.framework.exception;
|
|
||||||
|
|
||||||
|
|
||||||
import lombok.Data;
|
|
||||||
import lombok.EqualsAndHashCode;
|
|
||||||
import org.springframework.http.HttpStatus;
|
|
||||||
import org.springframework.web.bind.annotation.ResponseStatus;
|
|
||||||
|
|
||||||
@EqualsAndHashCode(callSuper = true)
|
|
||||||
@Data
|
|
||||||
@ResponseStatus(HttpStatus.CREATED)
|
|
||||||
public class FileterException extends RuntimeException {
|
|
||||||
|
|
||||||
private static final long serialVersionUID = 1L;
|
|
||||||
|
|
||||||
private String reason;
|
|
||||||
|
|
||||||
public FileterException(String cause) {
|
|
||||||
super(cause);
|
|
||||||
this.reason = cause;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue