詳細(xì)談?wù)凧ava過濾器的作用?

開發(fā)步驟

Filter開發(fā)分為2步：

過濾器處理字符集范例：

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * @description 過濾器Filter的工作原理
 */
public class FilterTest implements Filter {
    public void destroy() {
        System.out.println("----Filter銷毀----");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        // 對request、response進(jìn)行一些預(yù)處理
        request.setCharacterEncoding("UTF-8");
        response.setCharacterEncoding("UTF-8");
        response.setContentType("text/html;charset=UTF-8");
        System.out.println("----調(diào)用service之前執(zhí)行一段代碼----");
        filterChain.doFilter(request, response);
        // 執(zhí)行目標(biāo)資源，放行
        System.out.println("----調(diào)用service之后執(zhí)行一段代碼----");
    }

    public void init(FilterConfig arg0) throws ServletException {
        System.out.println("----Filter初始化----");
    }
}

在一個web應(yīng)用中，可以開發(fā)編寫多個Filter，這些Filter組合起來稱之為一個Filter鏈。web服務(wù)器根據(jù)Filter在web.xml文件中的注冊順序，決定先調(diào)用哪個Filter，當(dāng)?shù)谝粋€Filter的doFilter方法被調(diào)用時，web服務(wù)器會創(chuàng)建一個代表Filter鏈的FilterChain對象傳遞給該方法。在doFilter方法中，開發(fā)人員如果調(diào)用了FilterChain對象的doFilter方法，則web服務(wù)器會檢查FilterChain對象中是否還有filter，如果有，則調(diào)用第2個filter，如果沒有，則調(diào)用目標(biāo)資源。

Spring框架下，過濾器的配置

如果項目中使用了Spring框架，那么，很多過濾器都不用自己來寫了，Spring為我們寫好了一些常用的過濾器。下面我們就以字符編碼的過濾器CharacterEncodingFilter為例，來看一下Spring框架下，如果配置過濾器。

package org.springframework.web.filter;

import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.util.ClassUtils;

public class CharacterEncodingFilter extends OncePerRequestFilter {
    private static final boolean responseSetCharacterEncodingAvailable = ClassUtils.hasMethod(class$javax$servlet$http$HttpServletResponse, "setCharacterEncoding", new Class[]{String.class});
    // 需要設(shè)置的編碼方式，為了支持可配置，Spring把編碼方式設(shè)置成了一個變量
    private String encoding;
    // 是否強(qiáng)制使用統(tǒng)一編碼，也是為了支持可配置
    private boolean forceEncoding;

    // 構(gòu)造器，在這里，Spring把forceEncoding的值默認(rèn)設(shè)置成了false
    public CharacterEncodingFilter() {
        this.forceEncoding = false;
    }

    // encoding/forceEncoding的setter方法
    public void setEncoding(String encoding) {
        this.encoding = encoding;
    }

    public void setForceEncoding(boolean forceEncoding) {
        this.forceEncoding = forceEncoding;
    }

    // Spring通過GenericFilterBean抽象類，對Filter接口進(jìn)行了整合，
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if ((this.encoding!= null) && (((this.forceEncoding) || (request.getCharacterEncoding() == null)))) {
            request.setCharacterEncoding(this.encoding);
            if ((this.forceEncoding) && (responseSetCharacterEncodingAvailable)) {
                response.setCharacterEncoding(this.encoding);
            }
        }
        filterChain.doFilter(request, response);
    }
}

接下來，我們看一下CharacterEncodingFilter這個過濾器的關(guān)鍵代碼

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.FilterChain;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.filter.CharacterEncodingFilter;

/**
 * InvalidCharacterFilter：過濾request請求中的非法字符，防止腳本攻擊
 * InvalidCharacterFilter繼承了Spring框架的CharacterEncodingFilter過濾器，當(dāng)然，我們也可以自己實現(xiàn)這樣一個過濾器
 */
public class InvalidCharacterFilter extends CharacterEncodingFilter {
    // 需要過濾的非法字符
    private static String[] invalidCharacter = new String[]{
            "script", "select", "insert", "document", "window", "function",
            "delete", "update", "prompt", "alert", "create", "alter", "drop",
            "iframe", "link", "where", "replace", "function", "onabort",
            "onactivate", "onafterprint", "onafterupdate", "onbeforeactivate",
            "onbeforecopy", "onbeforecut", "onbeforedeactivateonfocus",
            "onkeydown", "onkeypress", "onkeyup", "onload", "expression",
            "applet", "layer", "ilayeditfocus", "onbeforepaste", "onbeforeprint",
            "onbeforeunload", "onbeforeupdate", "onblur", "onbounce",
            "oncellchange", "oncontextmenu", "oncontrolselect", "oncopy",
            "oncut", "ondataavailable", "ondatasetchanged", "ondatasetcomplete",
            "ondeactivate", "ondrag", "ondrop", "onerror", "onfilterchange",
            "onfinish", "onhelp", "onlayoutcomplete", "onlosecapture", "onmouse",
            "ote", "onpropertychange", "onreadystatechange", "onreset", "onresize",
            "onresizeend", "onresizestart", "onrow", "onscroll", "onselect",
            "onstaronsubmit", "onunload", "IMgsrc", "infarction"
    };

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String parameterName = null;
        String parameterValue = null;
        // 獲取請求的參數(shù)
        @SuppressWarnings("unchecked")
        Enumeration<String> allParameter = request.getParameterNames();
        while (allParameter.hasMoreElements()) {
            parameterName = allParameter.nextElement();
            parameterValue = request.getParameter(parameterName);
            if (null!= parameterValue) {
                for (String str : invalidCharacter) {
                    if (StringUtils.containsIgnoreCase(parameterValue, str)) {
                        request.setAttribute("errorMessage", "非法字符：" + str);
                        RequestDispatcher requestDispatcher = request.getRequestDispatcher("/error.jsp");
                        requestDispatcher.forward(request, response);
                        return;
                    }
                }
            }
        }
        super.doFilterInternal(request, response, filterChain);
    }
}

GenericFilterBean類：

public abstract class GenericFilterBean implements Filter, BeanNameAware, ServletContextAware, InitializingBean, DisposableBean

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.FilterChain;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.filter.CharacterEncodingFilter;

/**
 * InvalidCharacterFilter：過濾request請求中的非法字符，防止腳本攻擊
 * InvalidCharacterFilter繼承了Spring框架的CharacterEncodingFilter過濾器，當(dāng)然，我們也可以自己實現(xiàn)這樣一個過濾器
 */
public class InvalidCharacterFilter extends CharacterEncodingFilter {
    // 需要過濾的非法字符
    private static String[] invalidCharacter = new String[]{
            "script", "select", "insert", "document", "window", "function",
            "delete", "update", "prompt", "alert", "create", "alter", "drop",
            "iframe", "link", "where", "replace", "function", "onabort",
            "onactivate", "onafterprint", "onafterupdate", "onbeforeactivate",
            "onbeforecopy", "onbeforecut", "onbeforedeactivateonfocus",
            "onkeydown", "onkeypress", "onkeyup", "onload", "expression",
            "applet", "layer", "ilayeditfocus", "onbeforepaste", "onbeforeprint",
            "onbeforeunload", "onbeforeupdate", "onblur", "onbounce",
            "oncellchange", "oncontextmenu", "oncontrolselect", "oncopy",
            "oncut", "ondataavailable", "ondatasetchanged", "ondatasetcomplete",
            "ondeactivate", "ondrag", "ondrop", "onerror", "onfilterchange",
            "onfinish", "onhelp", "onlayoutcomplete", "onlosecapture", "onmouse",
            "ote", "onpropertychange", "onreadystatechange", "onreset", "onresize",
            "onresizeend", "onresizestart", "onrow", "onscroll", "onselect",
            "onstaronsubmit", "onunload", "IMgsrc", "infarction"
    };

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String parameterName = null;
        String parameterValue = null;
        // 獲取請求的參數(shù)
        @SuppressWarnings("unchecked")
        Enumeration<String> allParameter = request.getParameterNames();
        while (allParameter.hasMoreElements()) {
            parameterName = allParameter.nextElement();
            parameterValue = request.getParameter(parameterName);
            if (null!= parameterValue) {
                for (String str : invalidCharacter) {
                    if (StringUtils.containsIgnoreCase(parameterValue, str)) {
                        request.setAttribute("errorMessage", "非法字符：" + str);
                        RequestDispatcher requestDispatcher = request.getRequestDispatcher("/error.jsp");
                        requestDispatcher.forward(request, response);
                        return;
                    }
                }
            }
        }
        super.doFilterInternal(request, response, filterChain);
    }
}

接下來需要在web.xml中進(jìn)行配置：

<filter>
    <filter-name>InvalidCharacterFilter</filter-name>
    <filter-class>com.test.filter.InvalidCharacterFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>InvalidCharacterFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class FilterTest implements Filter {
    /* 過濾器初始化
     * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
     */
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("----過濾器初始化----");
        // 得到過濾器的名字
        String filterName = filterConfig.getFilterName();
        // 得到在web.xml文件中配置的初始化參數(shù)
        String initParam1 = filterConfig.getInitParameter("name");
        String initParam2 = filterConfig.getInitParameter("like");
        // 返回過濾器的所有初始化參數(shù)的名字的枚舉集合。
        Enumeration<String> initParameterNames = filterConfig.getInitParameterNames();
        System.out.println(filterName);
        System.out.println(initParam1);
        System.out.println(initParam2);
        while (initParameterNames.hasMoreElements()) {
            String paramName = (String) initParameterNames.nextElement();
            System.out.println(paramName);
        }
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("FilterDemo02執(zhí)行前?。?！");
        chain.doFilter(request, response); // 讓目標(biāo)資源執(zhí)行，放行
        System.out.println("FilterDemo02執(zhí)行后！?。?);
    }

    @Override
    public void destroy() {
        System.out.println("----過濾器銷毀----");
    }
}