快捷導(dǎo)航

Springboot中如何使用過濾器校驗(yàn)PSOT類型請(qǐng)求參數(shù)內(nèi)容

更新時(shí)間：2023年08月11日 09:38:19 作者：想養(yǎng)一只！

在Springboot中創(chuàng)建過濾器,用來過濾所有POST類型請(qǐng)求并獲取body中的參數(shù)進(jìn)行校驗(yàn)內(nèi)容是否合法,該方法僅適用于POST類型請(qǐng)求,本文給大家介紹Springboot中如何使用過濾器校驗(yàn)PSOT類型請(qǐng)求參數(shù)內(nèi)容,感興趣的朋友一起看看吧

目的

在Springboot中創(chuàng)建過濾器，用來過濾所有POST類型請(qǐng)求并獲取body中的參數(shù)進(jìn)行校驗(yàn)內(nèi)容是否合法；該方法僅適用于POST類型請(qǐng)求，因?yàn)镻OST和GET請(qǐng)求的參數(shù)位置不一樣所以處理方式也不一樣，如果想要實(shí)現(xiàn)攔截獲取GET類型請(qǐng)求校驗(yàn)參數(shù)，可以參考以下示例：

Springboot中攔截GET請(qǐng)求獲取請(qǐng)求參數(shù)驗(yàn)證合法性

實(shí)現(xiàn)步驟

1、創(chuàng)建Filter過濾器用來過濾所有請(qǐng)求；

2、將PSOT類型請(qǐng)求中的body參數(shù)內(nèi)容進(jìn)行轉(zhuǎn)換；

3、處理body數(shù)據(jù)進(jìn)行校驗(yàn)：

3.1、當(dāng)body數(shù)據(jù)僅為json對(duì)象時(shí)進(jìn)行處理校驗(yàn)；

3.2、當(dāng)body數(shù)據(jù)僅為json數(shù)組時(shí)進(jìn)行處理校驗(yàn)；

3.3、當(dāng)body數(shù)據(jù)為json對(duì)象且包含json數(shù)組時(shí)進(jìn)行處理校驗(yàn)；

3.4、當(dāng)body數(shù)據(jù)為json數(shù)組且包含json對(duì)象時(shí)進(jìn)行處理校驗(yàn)；

完整代碼

過濾器

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.boc.ljh.utils.Result;
import com.boc.ljh.utils.status.AppErrorCode;
import org.springframework.context.annotation.Configuration;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;
import java.util.Map;
import java.util.Set;
/**
 * @Author: ljh
 * @ClassName SqlFilter
 * @Description 過濾請(qǐng)求內(nèi)容 防止sql注入
 * @date 2023/8/8 16:15
 * @Version 1.0
 */
@WebFilter(urlPatterns = "/*", filterName = "sqlFilter")
@Configuration
public class SqlFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) {
    }
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        response.setContentType("application/json;charset=utf-8");
        Result result = new Result();
        result.setStatus(500);
        result.setMessage(AppErrorCode.REQUEST_DATA_FULL.message);
        String data = JSON.toJSONString(result);
        BodyReaderRequestWrapper wrapper = null;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        if (request.getMethod().equals("POST")) {
            String contentType = request.getContentType();
            if ("application/json".equals(contentType)) {
                wrapper = new BodyReaderRequestWrapper(request);
                String requestPostStr = wrapper.getBody();
                if (requestPostStr.startsWith("{")) {
                    //解析json對(duì)象
                    boolean b = resolveJSONObjectObj(requestPostStr);
                    if (!b) {
                        response.getWriter().print(data);
                        return;
                    }
                } else if (requestPostStr.startsWith("[")) {
                    //把數(shù)據(jù)轉(zhuǎn)換成json數(shù)組
                    JSONArray jsonArray = JSONArray.parseArray(requestPostStr);
                    List<String> list = JSONObject.parseArray(jsonArray.toJSONString(), String.class);
                    for (String str : list) {
                        if (str.startsWith("{")) {
                            //解析json對(duì)象
                            boolean b = resolveJSONObjectObj(requestPostStr);
                            if (!b) {
                                response.getWriter().print(data);
                                return;
                            }
                        } else {
                            boolean b = verifySql(str);
                            if (b) {
                                try {
                                    response.getWriter().print(data);
                                    return;
                                } catch (IOException e) {
                                    e.printStackTrace();
                                }
                            }
                        }
                    }
                }
            } else {
                //application/x-www-form-urlencoded
                Map<String, String[]> parameterMap = request.getParameterMap();
                for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
                    //校驗(yàn)參數(shù)值是否合法
                    String[] value = entry.getValue();
                    for (String s : value) {
                        //校驗(yàn)參數(shù)值是否合法
                        boolean b = verifySql(s);
                        if (b) {
                            response.getWriter().print(data);
                            return;
                        }
                    }
                }
            }
        }
        if (wrapper == null) {
            filterChain.doFilter(servletRequest, servletResponse);
        } else {
            filterChain.doFilter(wrapper, servletResponse);
        }
    }
    /**
     * @Author: ljh
     * @Description: 對(duì)JSONObject對(duì)象進(jìn)行遞歸參數(shù)解析
     * @DateTime: 14:26 2023/8/9
     * @Params:
     * @Return
     */
    private boolean resolveJSONObjectObj(String requestPostStr) {
        boolean isover = true;
        // 創(chuàng)建需要處理的json對(duì)象
        JSONObject jsonObject = JSONObject.parseObject(requestPostStr);
        // 獲取所有的參數(shù)key
        Set<String> keys = jsonObject.keySet();
        if (keys.size() > 0) {
            for (String key : keys) {
                //獲取參數(shù)名稱
                String value;
                if (jsonObject.get(key) != null) {
                    value = String.valueOf(jsonObject.get(key));
                    //當(dāng)value為數(shù)組時(shí)
                    if (value.startsWith("[")) {
                        //把數(shù)據(jù)轉(zhuǎn)換成json數(shù)組
                        JSONArray jsonArray = JSONArray.parseArray(value);
                        for (Object o : jsonArray) {
                            if (o.toString().startsWith("{")) {
                                //解析json對(duì)象
                                boolean b = resolveJSONObjectObj(o.toString());
                                if (!b) {
                                    isover = false;
                                    break;
                                }
                            } else {
                                boolean b = verifySql(value);
                                if (b) {
                                    isover = false;
                                    break;
                                }
                            }
                        }
                    } else if (value.startsWith("{")) {
                        boolean b = resolveJSONObjectObj(value);
                        if (!b) {
                            isover = false;
                            break;
                        }
                    } else {
                        //校驗(yàn)參數(shù)值是否合法
                        boolean b = verifySql(value);
                        if (b) {
                            isover = false;
                            break;
                        }
                    }
                }
            }
        }
        return isover;
    }
    @Override
    public void destroy() {
    }
    /**
     * @Author: ljh
     * @Description: 校驗(yàn)參數(shù)非法字符
     * @DateTime: 14:26 2023/8/9
     * @Params:
     * @Return
     */
    public boolean verifySql(String parameter) {
        String s = parameter.toLowerCase();
        // 過濾掉的sql關(guān)鍵字，特殊字符前面需要加\\進(jìn)行轉(zhuǎn)義
        String badStr =
                "select|update|and|or|delete|insert|truncate|char|into|substr|ascii|declare|exec|count|master|into|drop|execute|table|" +
                        "char|declare|sitename|xp_cmdshell|like|from|grant|use|group_concat|column_name|" +
                        "information_schema.columns|table_schema|union|where|order|by|" +
                        "'\\*|\\;|\\-|\\--|\\+|\\,|\\//|\\/|\\%|\\#";
        //使用正則表達(dá)式進(jìn)行匹配
        boolean matches = s.matches(badStr);
        return matches;
    }
}

解析body數(shù)據(jù) 工具類

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.*;
/**
 * @Author: ljh
 * @ClassName BodyReaderRequestWrapper
 * @Description 解析body數(shù)據(jù)
 * @date 2023/8/8 16:14
 * @Version 1.0
 */
public class BodyReaderRequestWrapper extends HttpServletRequestWrapper {
    private final String body;
    public String getBody() {
        return body;
    }
    /**
     * 取出請(qǐng)求體body中的參數(shù)（創(chuàng)建對(duì)象時(shí)執(zhí)行）
     *
     * @param request
     */
    public BodyReaderRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        StringBuilder sb = new StringBuilder();
        InputStream ins = request.getInputStream();
        BufferedReader isr = null;
        try {
            if (ins != null) {
                isr = new BufferedReader(new InputStreamReader(ins));
                char[] charBuffer = new char[128];
                int readCount;
                while ((readCount = isr.read(charBuffer)) != -1) {
                    sb.append(charBuffer, 0, readCount);
                }
            }
        } finally {
            if (isr != null) {
                isr.close();
            }
        }
        sb.toString();
        body = sb.toString();
    }
    @Override
    public BufferedReader getReader() {
        return new BufferedReader(new InputStreamReader(this.getInputStream()));
    }
    @Override
    public ServletInputStream getInputStream() {
        final ByteArrayInputStream byteArrayIns = new ByteArrayInputStream(body.getBytes());
        return new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return false;
            }
            @Override
            public boolean isReady() {
                return false;
            }
            @Override
            public void setReadListener(ReadListener readListener) {
            }
            @Override
            public int read() {
                return byteArrayIns.read();
            }
        };
    }
}

到此這篇關(guān)于Springboot中如何使用過濾器校驗(yàn)PSOT類型請(qǐng)求參數(shù)內(nèi)容的文章就介紹到這了,更多相關(guān)Springboot校驗(yàn)PSOT請(qǐng)求參數(shù)內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

您可能感興趣的文章: