java 过滤器

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

import com.soufun.wap.servlet.XSSRequestWrapper;

public class SqlXssFilter implements Filter {

private FilterConfig config = null; //配置文件(可以从 web中获取参数)

@Override

public void init(FilterConfig filterConfig) throws ServletException {

this.config = filterConfig;

}

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

HttpServletRequest req = (HttpServletRequest) request;

//对不是 get请求和post 请求 进行拦截

if(!(req.getMethod().equalsIgnoreCase("get")||req.getMethod().equalsIgnoreCase("post"))) { //

return;

}

chain.doFilter(new XSSRequestWrapper(req), response); //放行

}

public void destroy() {

}

/**

* 获取敏感字

* 在 web.xml 中获取获取敏感字符所在的路径

* 在把它变为流 读进集合里面

*/

private List

getDirtyWords(){

List

dirtyWords = new ArrayList

(); String dirtyWordPath = config.getInitParameter("dirtyWord"); //获取参数值 InputStream inputStream = config.getServletContext().getResourceAsStream(dirtyWordPath); //传入路径变为流 InputStreamReader is = null; try { is = new InputStreamReader(inputStream,"UTF-8"); //把流转换为utf-8编码 } catch (UnsupportedEncodingException e2) { e2.printStackTrace(); } BufferedReader reader = new BufferedReader(is); String line; try { while ((line = reader.readLine())!= null) {//如果 line为空说明读完了 dirtyWords.add(line); //把敏感字符丢进集合里面 } } catch (IOException e) { e.printStackTrace(); } return dirtyWords; } }

装饰着模式 重写httpservlet中的方法

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang.StringEscapeUtils;

public class XSSRequestWrapper extends HttpServletRequestWrapper {

public XSSRequestWrapper(HttpServletRequest servletRequest) {

super(servletRequest);

}

/*

*重写getParameterValues方法

*/

@Override

public String[] getParameterValues(String parameter) {

String[] values = super.getParameterValues(parameter); //调用父类getParameterValues 获取原始值

if ("pageChildren".equals(parameter)) { //对原始值进行判断做出选择

return values;

}

if (values == null) {

return null;

}

int count = values.length;

String[] encodedValues = new String[count]; //创建一个字符数组

for (int i = 0; i < count; i++) {

encodedValues[i] = stripXSS(values[i]); //循坏替换 值中的关键字

}

return encodedValues;

}

/*

*重写getParameter方法方法

*/

@Override

public String getParameter(String parameter) {

String value = super.getParameter(parameter); //调用父类获取原始值

return stripXSS(value); //替换

}

/*

*对值中的关键字进行替换

*/

private String stripXSS(String value) {

if (null != value) {

value = value.replaceAll("", ">");

value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");

value = value.replaceAll("'", "'");

value = value.replaceAll("eval\\((.*)\\)", "");

value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

value = value.replaceAll("script", "");

value = StringEscapeUtils.escapeSql(value);

}

return value;

}

}

web.xml

sqlXssFilter

com.soufun.wap.filter.SqlXssFilter

dirtyWord

/WEB-INF/DirtyWord.txt

sqlXssFilter

/*