<filter><filter-name>HazardousParametersFilter</filter-name><filter-class>com.galaxy.apps.common.HazardousParametersFilter</filter-class><init-param><param-name>ignoreRegex</param-name><param-value>/upload/mobileUploadPic</param-value></init-param>
</filter>
<filter-mapping><filter-name>HazardousParametersFilter</filter-name><url-pattern>/*</url-pattern>
</filter-mapping>

 <init-param><param-name>ignoreRegex</param-name><param-value>/upload/mobileUploadPic</param-value></init-param>

package com.galaxy.apps.common;import java.io.IOException;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;import org.apache.commons.lang3.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;import com.galaxy.apps.utils.HazardousParameterHelper;
import com.jovtec.galaxy.util.RequestHelper;
import com.jovtec.galaxy.util.StringHelper;public class HazardousParametersFilter implements Filter {private static final Log logger = LogFactory.getLog("SecurityLogger");private String ignoreRegex;private String[] ignoreRegexArray;public String getIgnoreRegex() {return ignoreRegex;}public void setIgnoreRegex(String ignoreRegex) {this.ignoreRegex = ignoreRegex;}public String[] getIgnoreRegexArray() {return ignoreRegexArray;}public void setIgnoreRegexArray(String[] ignoreRegexArray) {this.ignoreRegexArray = ignoreRegexArray;}public void init(FilterConfig filterConfig) throws ServletException {ignoreRegex = filterConfig.getInitParameter("ignoreRegex");if (StringUtils.isNotEmpty(ignoreRegex)) {ignoreRegexArray = ignoreRegex.split(",");}return;}public void destroy() {}public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) servletRequest;String requestURI = request.getRequestURI();boolean isExcludedPage = false;for (String page : ignoreRegexArray) {// 判断是否在过滤url之外if (request.getServletPath().equals(page)) {isExcludedPage = true;break;}}// 如果得不到URI，或者URI是后台地址，则直接返回if (StringHelper.isEmpty(requestURI) || requestURI.startsWith("/portal/") || isExcludedPage) {filterChain.doFilter(servletRequest, servletResponse);return;}// TODO html、shtml如何优化性能？也需要过滤，否则shtml的include无法进入本filter// TODO 忽略ignoreRegex指定的URL，/portal/也应该到这个里面去忽略boolean hasHazardous = false;Map pm = servletRequest.getParameterMap();if (pm != null && !pm.isEmpty()) { // 性能优化Set keySet = pm.keySet();for (Iterator iterator = keySet.iterator(); iterator.hasNext();) {String key = (String) iterator.next();String[] values = (String[]) pm.get(key);if (HazardousParameterHelper.hasHazardousChar(values)) {hasHazardous = true;break;}}}// 如果有风险字符，则将其转义，记录日志，继续执行程序if (hasHazardous) {logger.info("该URL接收了风险字符参数：" + request.getRequestURL() + "，客户IP:" + request.getRemoteAddr() + "，参数列表："+ RequestHelper.getParameterMapToString(pm));HazardousRequestWrapper hazReqWrapper = new HazardousRequestWrapper(request);filterChain.doFilter(hazReqWrapper, servletResponse);} else {filterChain.doFilter(servletRequest, servletResponse);}}
}