詳細(xì)談?wù)凧ava過(guò)濾器的作用?

開(kāi)發(fā)步驟

Filter開(kāi)發(fā)分為2步：

過(guò)濾器處理字符集范例：

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * @description 過(guò)濾器Filter的工作原理
 */
public class FilterTest implements Filter {
    public void destroy() {
        System.out.println("----Filter銷毀----");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        // 對(duì)request、response進(jìn)行一些預(yù)處理
        request.setCharacterEncoding("UTF-8");
        response.setCharacterEncoding("UTF-8");
        response.setContentType("text/html;charset=UTF-8");
        System.out.println("----調(diào)用service之前執(zhí)行一段代碼----");
        filterChain.doFilter(request, response);
        // 執(zhí)行目標(biāo)資源，放行
        System.out.println("----調(diào)用service之后執(zhí)行一段代碼----");
    }

    public void init(FilterConfig arg0) throws ServletException {
        System.out.println("----Filter初始化----");
    }
}

在一個(gè)web應(yīng)用中，可以開(kāi)發(fā)編寫多個(gè)Filter，這些Filter組合起來(lái)稱之為一個(gè)Filter鏈。web服務(wù)器根據(jù)Filter在web.xml文件中的注冊(cè)順序，決定先調(diào)用哪個(gè)Filter，當(dāng)?shù)谝粋€(gè)Filter的doFilter方法被調(diào)用時(shí)，web服務(wù)器會(huì)創(chuàng)建一個(gè)代表Filter鏈的FilterChain對(duì)象傳遞給該方法。在doFilter方法中，開(kāi)發(fā)人員如果調(diào)用了FilterChain對(duì)象的doFilter方法，則web服務(wù)器會(huì)檢查FilterChain對(duì)象中是否還有filter，如果有，則調(diào)用第2個(gè)filter，如果沒(méi)有，則調(diào)用目標(biāo)資源。

Spring框架下，過(guò)濾器的配置

如果項(xiàng)目中使用了Spring框架，那么，很多過(guò)濾器都不用自己來(lái)寫了，Spring為我們寫好了一些常用的過(guò)濾器。下面我們就以字符編碼的過(guò)濾器CharacterEncodingFilter為例，來(lái)看一下Spring框架下，如果配置過(guò)濾器。

package org.springframework.web.filter;

import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.util.ClassUtils;

public class CharacterEncodingFilter extends OncePerRequestFilter {
    private static final boolean responseSetCharacterEncodingAvailable = ClassUtils.hasMethod(class$javax$servlet$http$HttpServletResponse, "setCharacterEncoding", new Class[]{String.class});
    // 需要設(shè)置的編碼方式，為了支持可配置，Spring把編碼方式設(shè)置成了一個(gè)變量
    private String encoding;
    // 是否強(qiáng)制使用統(tǒng)一編碼，也是為了支持可配置
    private boolean forceEncoding;

    // 構(gòu)造器，在這里，Spring把forceEncoding的值默認(rèn)設(shè)置成了false
    public CharacterEncodingFilter() {
        this.forceEncoding = false;
    }

    // encoding/forceEncoding的setter方法
    public void setEncoding(String encoding) {
        this.encoding = encoding;
    }

    public void setForceEncoding(boolean forceEncoding) {
        this.forceEncoding = forceEncoding;
    }

    // Spring通過(guò)GenericFilterBean抽象類，對(duì)Filter接口進(jìn)行了整合，
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if ((this.encoding!= null) && (((this.forceEncoding) || (request.getCharacterEncoding() == null)))) {
            request.setCharacterEncoding(this.encoding);
            if ((this.forceEncoding) && (responseSetCharacterEncodingAvailable)) {
                response.setCharacterEncoding(this.encoding);
            }
        }
        filterChain.doFilter(request, response);
    }
}

接下來(lái)，我們看一下CharacterEncodingFilter這個(gè)過(guò)濾器的關(guān)鍵代碼

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.FilterChain;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.filter.CharacterEncodingFilter;

/**
 * InvalidCharacterFilter：過(guò)濾request請(qǐng)求中的非法字符，防止腳本攻擊
 * InvalidCharacterFilter繼承了Spring框架的CharacterEncodingFilter過(guò)濾器，當(dāng)然，我們也可以自己實(shí)現(xiàn)這樣一個(gè)過(guò)濾器
 */
public class InvalidCharacterFilter extends CharacterEncodingFilter {
    // 需要過(guò)濾的非法字符
    private static String[] invalidCharacter = new String[]{
            "script", "select", "insert", "document", "window", "function",
            "delete", "update", "prompt", "alert", "create", "alter", "drop",
            "iframe", "link", "where", "replace", "function", "onabort",
            "onactivate", "onafterprint", "onafterupdate", "onbeforeactivate",
            "onbeforecopy", "onbeforecut", "onbeforedeactivateonfocus",
            "onkeydown", "onkeypress", "onkeyup", "onload", "expression",
            "applet", "layer", "ilayeditfocus", "onbeforepaste", "onbeforeprint",
            "onbeforeunload", "onbeforeupdate", "onblur", "onbounce",
            "oncellchange", "oncontextmenu", "oncontrolselect", "oncopy",
            "oncut", "ondataavailable", "ondatasetchanged", "ondatasetcomplete",
            "ondeactivate", "ondrag", "ondrop", "onerror", "onfilterchange",
            "onfinish", "onhelp", "onlayoutcomplete", "onlosecapture", "onmouse",
            "ote", "onpropertychange", "onreadystatechange", "onreset", "onresize",
            "onresizeend", "onresizestart", "onrow", "onscroll", "onselect",
            "onstaronsubmit", "onunload", "IMgsrc", "infarction"
    };

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String parameterName = null;
        String parameterValue = null;
        // 獲取請(qǐng)求的參數(shù)
        @SuppressWarnings("unchecked")
        Enumeration<String> allParameter = request.getParameterNames();
        while (allParameter.hasMoreElements()) {
            parameterName = allParameter.nextElement();
            parameterValue = request.getParameter(parameterName);
            if (null!= parameterValue) {
                for (String str : invalidCharacter) {
                    if (StringUtils.containsIgnoreCase(parameterValue, str)) {
                        request.setAttribute("errorMessage", "非法字符：" + str);
                        RequestDispatcher requestDispatcher = request.getRequestDispatcher("/error.jsp");
                        requestDispatcher.forward(request, response);
                        return;
                    }
                }
            }
        }
        super.doFilterInternal(request, response, filterChain);
    }
}

GenericFilterBean類：

public abstract class GenericFilterBean implements Filter, BeanNameAware, ServletContextAware, InitializingBean, DisposableBean

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.FilterChain;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.filter.CharacterEncodingFilter;

/**
 * InvalidCharacterFilter：過(guò)濾request請(qǐng)求中的非法字符，防止腳本攻擊
 * InvalidCharacterFilter繼承了Spring框架的CharacterEncodingFilter過(guò)濾器，當(dāng)然，我們也可以自己實(shí)現(xiàn)這樣一個(gè)過(guò)濾器
 */
public class InvalidCharacterFilter extends CharacterEncodingFilter {
    // 需要過(guò)濾的非法字符
    private static String[] invalidCharacter = new String[]{
            "script", "select", "insert", "document", "window", "function",
            "delete", "update", "prompt", "alert", "create", "alter", "drop",
            "iframe", "link", "where", "replace", "function", "onabort",
            "onactivate", "onafterprint", "onafterupdate", "onbeforeactivate",
            "onbeforecopy", "onbeforecut", "onbeforedeactivateonfocus",
            "onkeydown", "onkeypress", "onkeyup", "onload", "expression",
            "applet", "layer", "ilayeditfocus", "onbeforepaste", "onbeforeprint",
            "onbeforeunload", "onbeforeupdate", "onblur", "onbounce",
            "oncellchange", "oncontextmenu", "oncontrolselect", "oncopy",
            "oncut", "ondataavailable", "ondatasetchanged", "ondatasetcomplete",
            "ondeactivate", "ondrag", "ondrop", "onerror", "onfilterchange",
            "onfinish", "onhelp", "onlayoutcomplete", "onlosecapture", "onmouse",
            "ote", "onpropertychange", "onreadystatechange", "onreset", "onresize",
            "onresizeend", "onresizestart", "onrow", "onscroll", "onselect",
            "onstaronsubmit", "onunload", "IMgsrc", "infarction"
    };

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String parameterName = null;
        String parameterValue = null;
        // 獲取請(qǐng)求的參數(shù)
        @SuppressWarnings("unchecked")
        Enumeration<String> allParameter = request.getParameterNames();
        while (allParameter.hasMoreElements()) {
            parameterName = allParameter.nextElement();
            parameterValue = request.getParameter(parameterName);
            if (null!= parameterValue) {
                for (String str : invalidCharacter) {
                    if (StringUtils.containsIgnoreCase(parameterValue, str)) {
                        request.setAttribute("errorMessage", "非法字符：" + str);
                        RequestDispatcher requestDispatcher = request.getRequestDispatcher("/error.jsp");
                        requestDispatcher.forward(request, response);
                        return;
                    }
                }
            }
        }
        super.doFilterInternal(request, response, filterChain);
    }
}

接下來(lái)需要在web.xml中進(jìn)行配置：

<filter>
    <filter-name>InvalidCharacterFilter</filter-name>
    <filter-class>com.test.filter.InvalidCharacterFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>InvalidCharacterFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class FilterTest implements Filter {
    /* 過(guò)濾器初始化
     * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
     */
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("----過(guò)濾器初始化----");
        // 得到過(guò)濾器的名字
        String filterName = filterConfig.getFilterName();
        // 得到在web.xml文件中配置的初始化參數(shù)
        String initParam1 = filterConfig.getInitParameter("name");
        String initParam2 = filterConfig.getInitParameter("like");
        // 返回過(guò)濾器的所有初始化參數(shù)的名字的枚舉集合。
        Enumeration<String> initParameterNames = filterConfig.getInitParameterNames();
        System.out.println(filterName);
        System.out.println(initParam1);
        System.out.println(initParam2);
        while (initParameterNames.hasMoreElements()) {
            String paramName = (String) initParameterNames.nextElement();
            System.out.println(paramName);
        }
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("FilterDemo02執(zhí)行前?。?！");
        chain.doFilter(request, response); // 讓目標(biāo)資源執(zhí)行，放行
        System.out.println("FilterDemo02執(zhí)行后?。。?);
    }

    @Override
    public void destroy() {
        System.out.println("----過(guò)濾器銷毀----");
    }
}