过滤特殊字符

记录：非法字符过滤 servletFilter,用户session验证servletFilter2010-02-03 11:19servletFilter 是非常强大的。

能过滤 页面提交过来的所有参数的内容，，例如用户可能会在表单中加入<script><script>这种字符，后果可是恐怖的。

现在发布一个非法字符转义的filter

JAVA CODE:

package com.jcxsw.filter;

import java.io.IOException;


import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class IllegalCharacterFilter implements Filter {

private static final long serialVersionUID = -5916500037685553487L;


public void destroy() {
   // TODO Auto-generated method stub

}

@SuppressWarnings("unchecked")
public void doFilter(ServletRequest request, ServletResponse response,
    FilterChain arg2) throws IOException, ServletException {
   HttpServletRequest servletrequest = (HttpServletRequest) request;
   HttpServletResponse servletresponse = (HttpServletResponse) response;
   String param = "";
   String paramValue = "";

   servletresponse.setContentType("text/html");
   servletresponse.setCharacterEncoding("gbk");
   servletrequest.setCharacterEncoding("gbk");
   java.util.Enumeration params = request.getParameterNames();
   while (params.hasMoreElements()) {

    param = (String) params.nextElement();
    String[] values = servletrequest.getParameterValues(param);//获得每个参数的value
  
    for (int i = 0; i < values.length; i++) {

     paramValue = values[i];
   
     paramValue = paramValue.replaceAll("<", "&lt");
     paramValue = paramValue.replaceAll(">", "&gt");

    //这里还可以增加，如领导人 自动转义成****,可以从数据库中读取非法关键字。
     values[i] = paramValue;
   
   

    }

//把转义后的参数重新放回request中
    request.setAttribute(param, paramValue);
   }
   //继续向下

   arg2.doFilter(request, response);

}

public void init(FilterConfig arg0) throws ServletException {
   // 初始化

}

}

web.xml code

<!-- 过滤非法字符 -->
<filter>
   <filter-name>IllegalCharacterFilter</filter-name>
   <filter-class>
    com.jcxsw.filter.IllegalCharacterFilter
   </filter-class>
</filter>
<filter-mapping>
   <filter-name>IllegalCharacterFilter</filter-name>
   <url-pattern>/*</url-pattern> <!--这种配置，可能连图片都会被过滤在内，它不支持不等于，与正则，不过可以在初始化中自己定义正则，通过filter来解析，把不符合的pass掉-->
</filter-mapping>

再发布一个验证session的filter

JAVA CODE:

package com.jcxsw.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.jcxsw.member.vo.MemberUser;

public class MemberAuthorityFilter implements Filter {

public void destroy() {
   // TODO Auto-generated method stub

}

public void doFilter(ServletRequest request, ServletResponse response,
    FilterChain chain) throws IOException, ServletException {
   // TODO Auto-generated method stub
   HttpServletRequest httpReq = (HttpServletRequest) request;
   HttpServletResponse httpRes = (HttpServletResponse) response;
   if (request instanceof HttpServletRequest) {
    MemberUser memberUser = (MemberUser)httpReq.getSession()  
     .getAttribute("memberUser");
  
    if(memberUser == null){
     httpRes.sendRedirect(httpReq.getContextPath()+"/member-user/login");
     return;
    }
  
}
   chain.doFilter(request, response);

}

public void init(FilterConfig filterConfig) throws ServletException {
   // TODO Auto-generated method stub

}

}
web.xml CODE

<filter-name>MemberAuthorityFilter</filter-name>
   <filter-class>
    com.jcxsw.filter.MemberAuthorityFilter
   </filter-class>
</filter>
<filter-mapping>
   <filter-name>MemberAuthorityFilter</filter-name>
   <url-pattern>/my/*</url-pattern><!--验证所有my目录下的-->
</filter-mapping>

评论

1 楼 snowstar123 2014-01-27  

如果是json的方式传值 这种方式可以过滤吗