利用切面和反射机制过滤请求中的特殊字符

直接上代码：

@Slf4j
@Aspect
@Configuration
public class xxxxxAspect {
static Pattern symbolPattern = Pattern.compile("[`~!@#$%^&*()+=|{}':;',\\[\\].<>/?~！@#￥%……&*（）——+|{}【】‘；：”“’。，、？]");
//根据需要改过滤范围
@Before("execution(* com.***..*.*(..))")
    public void permissionCheck(JoinPoint point) {
//        System.out.println("@Before：模拟权限检查...");
//        System.out.println("@Before：目标方法为：" +
//                point.getSignature().getDeclaringTypeName() +
//                "." + point.getSignature().getName());
//        System.out.println("@Before：参数为：" + Arrays.toString(point.getArgs()));
//        System.out.println("@Before：被织入的目标对象为：" + point.getTarget());

        Object[] args = point.getArgs();
        MethodSignature methodSignature = (MethodSignature) point.getSignature();
        String[] parameterNames = methodSignature.getParameterNames();
        Class[] parameterTypes = methodSignature.getParameterTypes();


        for (int i = 0; i < parameterNames.length; i++) {
            if (XXXXXClass.class.isAssignableFrom(parameterTypes[i])) {
                System.out.println("before replace:" + args[i]);
                XXXXXClass xxxxx = (XXXXXClass) args[i];
                Class c = xxxxx.getClass();
                // 获取实体类的所有属性，返回Field数组
                Field[] field = c.getDeclaredFields();
                for (int j = 0; j < field.length; j++) {
                    // 获取属性的名字
                    String name = field[j].getName();
                    if (String.class == field[j].getType() && StringUtils.isNotEmpty(name)) {
                        name = (new StringBuilder()).append(Character.toUpperCase(name.charAt(0))).append(name.substring(1)).toString();
                        try {
                            Method m = c.getMethod("get" + name);
                            // 调用getter方法获取属性值
                            String value = String.valueOf(m.invoke(xxxxx));
                            if (StringUtils.isNotEmpty(value) && !"null".equals(value)) {
                                log.info("原请求参数为：" + name + "===" + value);
                                m = c.getMethod("set" + name, String.class);
                                Matcher matcher = symbolPattern.matcher(value);
                                value = matcher.replaceAll("").trim();
                                m.invoke(xxxxx, value);
                                log.info("替换特殊字符后的请求参数为：" + name + "===" + value);
                            }
                        } catch (NoSuchMethodException e) {
                            log.error("before异常NoSuchMethodException:", e);
                        } catch (IllegalAccessException e) {
                            log.error("before异常IllegalAccessException:", e);
                        } catch (InvocationTargetException e) {
                            log.error("before异常InvocationTargetException:", e);
                        }
                    }
                }
            }
        }
}

如果帮到你，请帮我点个赞！