使用RequestBodyAdvice實現(xiàn)對Http請求非法字符過濾
更新時間：2021年06月29日 10:29:59 作者：盲目的拾荒者
這篇文章主要介紹了使用RequestBodyAdvice實現(xiàn)對Http請求非法字符過濾的操作，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教
RequestBodyAdvice對Http請求非法字符過濾
利用RequestBodyAdvice對HTTP請求參數放入body中的參數進行非法字符過濾。
要求：spring 4.2+
額外的pom.xml
<dependency> <groupId>org.apache.commons</groupId> <artifactId>commons-io</artifactId> <version>1.3.2</version> </dependency> <dependency> <groupId>com.alibaba</groupId> <artifactId>fastjson</artifactId> <version>1.2.44</version> </dependency>
代碼
package com.niugang.controller;
import java.io.IOException;
import java.io.InputStream;
import java.lang.reflect.Type;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;
import org.apache.commons.io.IOUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.core.MethodParameter;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpInputMessage;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdvice;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
/**
* RequestBodyAdvice:解釋
* 允許在將請求的主體讀取和轉換成一個對象之前對請求進行自定義，
* 并允許在將其傳遞到控制器方法作為一個@RequestBody或HttpEntity方法參數之前處理結果對象。
*
* @author niugang
*
*/
@ControllerAdvice(basePackages = "com.niugang")
public class MyRequestBodyAdvice implements RequestBodyAdvice {
private final static Logger logger = LoggerFactory.getLogger(MyRequestBodyAdvice.class);
@Override
public boolean supports(MethodParameter methodParameter, Type targetType,
Class<? extends HttpMessageConverter<?>> converterType) {
return true;
}
@Override
public Object handleEmptyBody(Object body, HttpInputMessage inputMessage, MethodParameter parameter,
Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
return body;
}
@Override
public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType,
Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
try {
return new MyHttpInputMessage(inputMessage);
} catch (Exception e) {
e.printStackTrace();
return inputMessage;
}
}
@Override
public Object afterBodyRead(Object body, HttpInputMessage inputMessage, MethodParameter parameter, Type targetType,
Class<? extends HttpMessageConverter<?>> converterType) {
return body;
}
class MyHttpInputMessage implements HttpInputMessage {
private HttpHeaders headers;
private InputStream body;
@SuppressWarnings("unchecked")
public MyHttpInputMessage(HttpInputMessage inputMessage) throws Exception {
String string = IOUtils.toString(inputMessage.getBody(), "UTF-8");
Map<String, Object> mapJson = (Map<String, Object>) JSON.parseObject(string, Map.class);
Map<String, Object> map = new HashMap<String, Object>();
Set<Entry<String, Object>> entrySet = mapJson.entrySet();
for (Entry<String, Object> entry : entrySet) {
String key = entry.getKey();
Object objValue = entry.getValue();
if (objValue instanceof String) {
String value = objValue.toString();
map.put(key, filterDangerString(value));
} else { // 針對結合的處理
@SuppressWarnings("rawtypes")
List<HashMap> parseArray = JSONArray.parseArray(objValue.toString(), HashMap.class);
List<Map<String, Object>> listMap = new ArrayList<Map<String, Object>>();
for (Map<String, Object> innerMap : parseArray) {
Map<String, Object> childrenMap = new HashMap<String, Object>();
Set<Entry<String, Object>> elseEntrySet = innerMap.entrySet();
for (Entry<String, Object> en : elseEntrySet) {
String innerKey = en.getKey();
Object innerObj = en.getValue();
if (innerObj instanceof String) {
String value = innerObj.toString();
childrenMap.put(innerKey, filterDangerString(value));
}
}
listMap.add(childrenMap);
}
map.put(key, listMap);
}
}
this.headers = inputMessage.getHeaders();
this.body = IOUtils.toInputStream(JSON.toJSONString(map), "UTF-8");
}
@Override
public InputStream getBody() throws IOException {
return body;
}
@Override
public HttpHeaders getHeaders() {
return headers;
}
}
private String filterDangerString(String value) {
if (value == null) {
return null;
}
value = value.replaceAll("\\|", "");
value = value.replaceAll("&", "");
value = value.replaceAll(";", "");
value = value.replaceAll("@", "");
value = value.replaceAll("'", "");
value = value.replaceAll("\\'", "");
value = value.replaceAll("<", "");
value = value.replaceAll("-", "");
value = value.replaceAll(">", "");
value = value.replaceAll("\\(", "");
value = value.replaceAll("\\)", "");
value = value.replaceAll("\\+", "");
value = value.replaceAll("\r", "");
value = value.replaceAll("\n", "");
value = value.replaceAll("script", "");
value = value.replaceAll("select", "");
value = value.replaceAll("\"", "");
value = value.replaceAll(">", "");
value = value.replaceAll("<", "");
value = value.replaceAll("=", "");
value = value.replaceAll("/", "");
return value;
}
}
對于以上的配置Controller接收參數需要加@RequestBody。
測試
過濾后的數據
自定義RequestBodyAdvice過濾Json表情符號
/**
* @Author: ZhiHao
* @Date: 2021/6/4 19:03
* @Description: 過濾表情符號, POST-json請求
* @Versions 1.0
**/
@ControllerAdvice
@Slf4j
public class FilterEmojiRequestBodyAdvice implements RequestBodyAdvice {
@Override
public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
Annotation[] annotations = methodParameter.getParameterAnnotations();
for (Annotation ann : annotations) {
Validated validatedAnn = AnnotationUtils.getAnnotation(ann, Validated.class);
if (validatedAnn != null || ann.annotationType().getSimpleName().startsWith("Valid")) {
return true;
}
}
return false;
}
@Override
public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
return inputMessage;
}
@Override
public Object afterBodyRead(Object body, HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
try {
this.filterEmojiAfterBody(body);
} catch (Exception e) {
log.info("過濾表情異常:{}", e);
}
return body;
}
private void filterEmojiAfterBody(Object body) throws IllegalAccessException {
if (null != body) {
Field[] fields = ReflectUtil.getFields(body.getClass());
for (int i = 0; i < fields.length; i++) {
Field field = fields[i];
if (field.isAnnotationPresent(Valid.class)) {
field.setAccessible(true);
this.filterEmojiAfterBody(field.get(body));
}
if (field.isAnnotationPresent(FilterEmoji.class)) {
field.setAccessible(true);
Object value = field.get(body);
if (value instanceof String) {
String str = filterEmoji(value.toString());
field.set(body, str);
}
}
}
}
}
@Override
public Object handleEmptyBody(Object body, HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
return body;
}
/**
* 過濾emoji 或者 其他非文字類型的字符
*
* @param source
* @return
*/
public static String filterEmoji(String source) {
if (StringUtils.isEmpty(source)) {
return "";
}
if (!containsEmoji(source)) {
return source;//如果不包含，直接返回
}
StringBuilder buf = new StringBuilder();
int len = source.length();
for (int i = 0; i < len; i++) {
char codePoint = source.charAt(i);
if (isNotEmojiCharacter(codePoint)) {
buf.append(codePoint);
}
}
return buf.toString().trim();
}
/**
* 檢測是否有emoji字符
*
* @param source
* @return 一旦含有就拋出
*/
public static boolean containsEmoji(String source) {
if (StringUtils.isBlank(source)) {
return false;
}
int len = source.length();
for (int i = 0; i < len; i++) {
char codePoint = source.charAt(i);
if (!isNotEmojiCharacter(codePoint)) {
//判斷到了這里表明，確認有表情字符
return true;
}
}
return false;
}
/**
* 判斷是否為非Emoji字符
*
* @param codePoint 比較的單個字符
* @return
*/
public static boolean isNotEmojiCharacter(char codePoint) {
return (codePoint == 0x0) ||
(codePoint == 0x9) ||
(codePoint == 0xA) ||
(codePoint == 0xD) ||
((codePoint >= 0x20) && (codePoint <= 0xD7FF)) ||
((codePoint >= 0xE000) && (codePoint <= 0xFFFD)) ||
((codePoint >= 0x10000) && (codePoint <= 0x10FFFF));
}
}
以上為個人經驗，希望能給大家一個參考，也希望大家多多支持腳本之家。
相關文章
接口在JAVA編程語言中是一個抽象類型，是抽象方法的集合，接口通常以interface來聲明。一個類通過繼承接口的方式，從而來繼承接口的抽象方法2021-10-10
這篇文章主要介紹了Java使用正則表達式去除小數點后面多余的0功能,結合具體實例形式分析了java字符串正則替換相關操作技巧,需要的朋友可以參考下2017-06-06
本篇文章主要介紹了淺談Java線程Thread.join方法解析，小編覺得挺不錯的，現(xiàn)在分享給大家，也給大家做個參考。一起跟隨小編過來看看吧2018-01-01
這篇文章主要介紹了Spring IOC推導與DI構造器注入，文中通過示例代碼介紹的非常詳細，對大家的學習或者工作具有一定的參考學習價值，需要的朋友們下面隨著小編來一起學習吧2023-02-02
說到線程的底層運行原理，想必各位也應該知道我們今天不可避免的要講到JVM 了。其實大家明白了Java的運行時數據區(qū)域，也就明白了線程的底層原理，今天帶著大家一步一步DEBUG，來看看線程到底是怎么運行的，順便把IDEA的DEBUG方法簡單講一下2021-06-06
這篇文章主要介紹了關于Spring工廠方法注入屬性方式,具有很好的參考價值,希望對大家有所幫助,如有錯誤或未考慮完全的地方,望不吝賜教2025-04-04
使用@PathVariable注解如何實現(xiàn)動態(tài)傳值
這篇文章主要介紹了使用@PathVariable注解如何實現(xiàn)動態(tài)傳值，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教2021-10-10
java配置多個過濾器優(yōu)先級以及幾個常用過濾器操作
這篇文章主要介紹了java配置多個過濾器優(yōu)先級以及幾個常用過濾器的操作，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教2021-07-07
SpringBoot利用Validation包實現(xiàn)高效參數校驗
如果不進行校驗就直接使用這些數據,可能會導致各種問題,那么SpringBoot如何利用Validation包實現(xiàn)高效參數校驗呢,下面讓我們一起來探討這個重要的話題吧2025-04-04
JDBC是Java DataBase Connectivity技術的簡稱,是一種可用于執(zhí)行 SQL語句的Java API,下面這篇文章主要給大家介紹了關于JDBC連接Mysql的5種方式,文中通過實例代碼介紹的非常詳細,需要的朋友可以參考下2023-04-04