JSP中过滤器的设置

JSP中过滤器的设置

package com.filter;

import java.io.IOException;

import java.net.URLDecoder;

import java.util.Arrays;

import java.util.HashSet;

import java.util.Map;

import java.util.Set;

import java.util.regex.Pattern;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

public class SQLFilter implements Filter{

    static String reg ="(?:')|(?:--)|(/\\*(?:.|[\\n\\r])*?\\*/)|\\b(select|update|and|or|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|into|drop|execute|DBMS_XMLQUERY.GETXML|DBMS_XMLQUERY.NEWCONTEXT)\\b|"

            + "\\b(?:script|eval|vbscript|javascript|base)\\b|(?:[`]+)|(?:<script>)|(?:\\b(?:onload|onerror|onunload|onclick|ondblclick)\\b)";

    // ?: 只匹配，不缓存匹配到的内容；

    // /\\*相当于匹配/*

    // . 表示任意可显示字符

    // \\b()\\b 表示单独匹配单词

    // [\\n\\r] 表示只要符合其中的任意一个；[1-9]也可以是一个范围；

    static Pattern sqlPattern = Pattern.compile(reg, Pattern.CASE_INSENSITIVE);

    @Override

    public void destroy() {

        // TODO Auto-generated method stub

    }

    @Override

    public void init(FilterConfig arg0) throws ServletException {

        // TODO Auto-generated method stub

    }

    @Override

    public void doFilter(final ServletRequest req, final ServletResponse resp,

            final FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        HttpServletResponse response = (HttpServletResponse)resp;

        String uri = request.getRequestURI();

        Set<String> passURIs = new HashSet<String>();

        passURIs.add("/dsp71025/kdxt/kysj/qlysscyj.jsp");

        passURIs.add("/dsp71025/kdxt/kysj/lkfsl.jsp");

        if(passURIs.contains(uri)){

        }else{

            Map<String,String[]> params =  request.getParameterMap();

            for(String pk : params.keySet()){

                String[] value = params.get(pk);

                if(!isValid(value)){

                    System.out.println("参数："+pk+"的值："+Arrays.toString(value)+"不合法！");

                    return ;

                }

            }

        }

        chain.doFilter(request, response);

    }

    private boolean isValid(String[] pValue){

        if(pValue != null && pValue.length > 0){

            for(int i=0;i<pValue.length;i++){

                String s = pValue[i];

                System.out.println("解码前的值： "+s);

                //"%"编码后为"%25"

                s = URLDecoder.decode(s.replaceAll("%", "%25"));

                System.out.println("解码后的值： "+s);

                if (sqlPattern.matcher(s).find()) {

                    return false;

                }

            }

        }

        return true;

    }

}