Spring Boot 中getReader() has already been called问题处理

最新推荐文章于 2025-01-06 17:26:41 发布

原创最新推荐文章于 2025-01-06 17:26:41 发布 · 1.7k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #开发语言

本文介绍了在Spring Boot应用中遇到getReader()已调用问题的背景和原因，即HttpServletRequest的流只能读取一次。提出了通过自定义HttpServletRequest包装类BodyReaderHttpServletRequestWrapper来保存Request Body，并覆盖getReader()和getInputStream()的方法，实现流的重新读取。同时，文章还强调了若要兼容form-data请求，需启用hiddenmethod过滤器，可在Spring Boot配置文件中进行相应设置。

1、问题：HttpServletRequest 的 getInputStream() 和 getReader() 都只能读取一次，由于 Request Body 是流的形式读取，流读了一次就没有，所以只能被调用一次，调用第二次就报错了。

2、解决方案：自定义HttpServletRequest包装类BodyReaderHttpServletRequestWrapper，然后放到过滤链

具体：先将 Request Body 保存，然后通过 Servlet 自带的 HttpServletRequestWrapper 类覆盖 getReader() 和getInputStream() 方法，使流从保存的body读取。然后再Filter中将ServletRequest替换为AuthenticationRequestWrapper。

package cn.gbits.oa.kernelsdk.security.xss;

import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.HashMap;
import java.util.Map;

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.springframework.util.StringUtils;

import cn.gbits.oa.kernelsdk.utils.JsoupUtil;
import cn.gbits.oa.kernelsdk.utils.SerializeUtils;


public class BodyReaderHttpServletRequestWrapper extends HttpServletRequestWrapper {
    private String requestBody = null;
    HttpServletRequest orgRequest = null;
    private boolean isIncludeRichText = false;
    private Map<String, String[]> requestMap = null;

    public BodyReaderHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
        if (requestBody == null) {
            try {
                requestMap = new HashMap<String, String[]>();
                requestBody = JsoupUtil.clean(readBody(request)).replaceAll("&nbsp;", "").replaceAll("&amp;", "&");

                /*
                 * String[] strs = requestBody.substring(1, requestBody.length()-1).split(","); requestBody="{"; for(String s:strs){ String[] ms =
                 * s.trim().split("="); if(ms.length>1&&ms[1]!=null) { if(!ms[0].startsWith("\"")){ requestBody+="\""+ms[0]+"\""+":"; }
                 * if(!ms[1].startsWith("\"")) { requestBody+="\""+ms[1]+"\""+","; } } } if(requestBody.endsWith(",")) {
                 * requestBody=requestBody.substring(0,requestBody.length()-1); } requestBody+="}";
                 */
            } catch (Exception ex) {

            }
        }
    }

    public String getRequestBody() {
        return requestBody;
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new CustomServletInputStream(requestBody);
    }

    @Override
    public Map<String, String[]> getParameterMap() {
        return requestMap;
    }

    private static String readBody(ServletRequest request) {
        StringBuilder sb = new StringBuilder();
        String inputLine;
        BufferedReader br = null;
        try {
            br = request.getReader();
            while ((inputLine = br.readLine()) != null) {
                sb.append(inputLine);
            }
        } catch (IOException e) {
            throw new RuntimeException("Failed to read body.", e);
        } finally {
            if (br != null) {
                try {
                    br.close();
                } catch (IOException e) {
                }
            }
        }
        return sb.toString();
    }

    private class CustomServletInputStream extends ServletInputStream {
        private ByteArrayInputStream buffer;

        public CustomServletInputStream(String body) {
            body = body == null ? "" : body;
            this.buffer = new ByteArrayInputStream(body.getBytes());
        }

        @Override
        public int read() throws IOException {
            return buffer.read();
        }

        @Override
        public boolean isFinished() {
            return buffer.available() == 0;
        }

        @Override
        public boolean isReady() {
            return true;
        }

        @Override
        public void setReadListener(ReadListener listener) {
            throw new RuntimeException("Not implemented");
        }
    }

    /**
     * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
     */
    @Override
    public String getParameter(String name) {
        if (("content".equals(name) || name.endsWith("WithHtml")) && !isIncludeRichText) {
            return super.getParameter(name);
        }
        name = JsoupUtil.clean(name);
        String value = super.getParameter(name);
        if (!StringUtils.isEmpty(value)) {
            value = JsoupUtil.clean(value);
        }
        return value;
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] arr = super.getParameterValues(name);

        if (arr != null) {
            for (int i = 0; i < arr.length; i++) {
                arr[i] = JsoupUtil.clean(arr[i]);
            }
        } else {
            if (!this.requestBody.isEmpty()) {
                arr = new String[1];
                arr[0] = SerializeUtils.getStringFromJsonNode(SerializeUtils.convertJsonString2ObjectNode(this.requestBody), name);
            }
        }
        return arr;
    }

    /**
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
     * getHeaderNames 也可能需要覆盖
     */
    @Override
    public String getHeader(String name) {
        name = JsoupUtil.clean(name);
        String value = super.getHeader(name);
        if (!StringUtils.isEmpty(value)) {
            value = JsoupUtil.clean(value);
        }
        return value;
    }

    /**
     * 获取最原始的request
     * 
     * @return
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    /**
     * 获取最原始的request的静态方法
     * 
     * @return
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof BodyReaderHttpServletRequestWrapper) {
            return ((BodyReaderHttpServletRequestWrapper) req).getOrgRequest();
        }

        return req;
    }

}

package cn.gbits.oa.security.xss;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.springframework.web.filter.GenericFilterBean;

/**
 * 核心请求处理，xss攻击过滤
 */
public class FileTranFilter extends GenericFilterBean {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        BodyReaderHttpServletRequestWrapper myRequest = new BodyReaderHttpServletRequestWrapper((HttpServletRequest) request);
        filterChain.doFilter(myRequest, response);
    }
}

package cn.qh.filecenter.config;

import cn.gbits.oa.kernelsdk.accesslog.AccessLoggingFilter;
import cn.gbits.oa.kernelsdk.config.HttpSessionConfig;
import cn.gbits.oa.kernelsdk.security.xss.KernelTranFilter;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableAsync;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.web.cors.CorsUtils;
import org.springframework.web.filter.CorsFilter;


@Configuration
@EnableWebSecurity
public class FileCenterConfig extends HttpSessionConfig{
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.csrf().disable()
				.cors()
				.and()
				.authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
				.and()
				.addFilterAfter(new AccessLoggingFilter(), CorsFilter.class)
				.addFilterAfter(new FileTranFilter(), AccessLoggingFilter.class)
				.addFilterAfter(SessionFilter.getInstance(),AccessLoggingFilter.class)
    			;
	}
}

3、特别注意：如果当前服务需要兼容form-data表单请求，还需要将 hiddenmethod 过滤器设置为启用，即在Spring Boot 的配置文件 application.properties加上以下配置即可

spring.mvc.hiddenmethod.filter.enabled=true

原因是在 Spring Boot 的 META-INF/spring-configuration-metadata.json 配置文件中，默认是关闭 Spring 的 hiddenmethod 过滤器的，只有在开启时，可以将请求转换为标准的http方法，使得支持GET、POST、PUT与DELETE请求，该过滤器为HiddenHttpMethodFilter。