关于tomcat,request.getParameterMap修改map值的问题

最新推荐文章于 2022-02-17 16:48:02 发布

原创最新推荐文章于 2022-02-17 16:48:02 发布 · 1k 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#tomcat #request #ParameterMap

request 同时被 3 个专栏收录

1 篇文章

订阅专栏

ParameterMap

1 篇文章

订阅专栏

tomcat

1 篇文章

订阅专栏

本文探讨了如何通过继承HttpServletRequestWrapper类来修改HttpServletRequest的getParameterMap数据，并解释了Tomcat中ParameterMap类的锁定机制。通过实例代码演示了如何实现对请求参数的XSS过滤和修改。

网上都是getParameterMap取到的数据不能修改但是我继承HttpServletRequestWrapper的类竟然修改成功了
看代码：


package com.uniresource.framework.security;

import java.util.Iterator;
import java.util.Map;
import java.util.Set;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.springframework.web.util.HtmlUtils;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
        super(servletRequest);
    }
    public String[] getParameterValues(String parameter) {
      String[] values = super.getParameterValues(parameter);
      if (values==null)  {
                  return null;
          }
      int count = values.length;
      String[] encodedValues = new String[count];
      for (int i = 0; i < count; i++) {
                 encodedValues[i] = cleanXSS(values[i]);
       }
      return encodedValues;
    }
    public String getParameter(String parameter) {
          String value = super.getParameter(parameter);
          if (value == null) {
                 return null;
                  }
          return cleanXSS(value);
    }

	@Override
	public Map getParameterMap() {
    	Map map=super.getParameterMap();
    	Set set=map.keySet();
    	Iterator iter=set.iterator();
    	while(iter.hasNext()){
    		String key=iter.next().toString();
    		Object obj=map.get(key);
    		String[] param=(String[])obj;
    		//String[] newParam=new String[param.length];
    		for(int i=0;i<param.length;i++){
    			String s=param[i];
    			param[i]=HtmlUtils.htmlEscape(s);
    			//newParam[i]=HtmlUtils.htmlEscape(s);
    		}
    		//map.put(key, newParam);
    	}
    	/*for(int i=0;i<map.size();i++){
    		Object obj=map.get(i);
    		if(obj instanceof String){
    			System.out.println(obj.toString());
    		}
    	}*/
		return map;
	}
	public String getHeader(String name) {
        String value = super.getHeader(name);
        if (value == null)
            return null;
        return cleanXSS(value);
    }
    private String cleanXSS(String value) {
        //You'll need to remove the spaces from the html entities below
        value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
        value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
        value = value.replaceAll("'", "& #39;");
        value = value.replaceAll("eval\\((.*)\\)", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("script", "ｓｃｒｉｐｔ");
        value = HtmlUtils.htmlEscape(value);
        return value;
    }

}

所以就去查看了下org.apache.catalina.util.ParameterMap的源码原来我的tomcat中这个类的locked是非锁定的。还是说现在的tomcat这个值都是非锁定状态的。

/*     */ package org.apache.catalina.util;
/*     */ 
/*     */ import java.util.HashMap;
/*     */ import java.util.Map;
/*     */ import org.apache.tomcat.util.res.StringManager;
/*     */ 
/*     */ public final class ParameterMap<K, V> extends HashMap<K, V>
/*     */ {
/*     */   private static final long serialVersionUID = 1L;
/* 101 */   private boolean locked = false;
/*     */ 
/* 129 */   private static final StringManager sm = StringManager.getManager("org.apache.catalina.util");
/*     */ 
/*     */   public ParameterMap()
/*     */   {
/*     */   }
/*     */ 
/*     */   public ParameterMap(int initialCapacity)
/*     */   {
/*  64 */     super(initialCapacity);
/*     */   }
/*     */ 
/*     */   public ParameterMap(int initialCapacity, float loadFactor)
/*     */   {
/*  78 */     super(initialCapacity, loadFactor);
/*     */   }
/*     */ 
/*     */   public ParameterMap(Map<K, V> map)
/*     */   {
/*  90 */     super(map);
/*     */   }
/*     */ 
/*     */   public boolean isLocked()
/*     */   {
/* 109 */     return this.locked;
/*     */   }
/*     */ 
/*     */   public void setLocked(boolean locked)
/*     */   {
/* 121 */     this.locked = locked;
/*     */   }
/*     */ 
/*     */   public void clear()
/*     */   {
/* 145 */     if (this.locked) {
/* 146 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 148 */     super.clear();
/*     */   }
/*     */ 
/*     */   public V put(K key, V value)
/*     */   {
/* 169 */     if (this.locked) {
/* 170 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 172 */     return super.put(key, value);
/*     */   }
/*     */ 
/*     */   public void putAll(Map<? extends K, ? extends V> map)
/*     */   {
/* 189 */     if (this.locked) {
/* 190 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 192 */     super.putAll(map);
/*     */   }
/*     */ 
/*     */   public V remove(Object key)
/*     */   {
/* 210 */     if (this.locked) {
/* 211 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 213 */     return super.remove(key);
/*     */   }
/*     */ }

/* Location:           E:\apache-tomcat-7.0.30\lib\catalina.jar
 * Qualified Name:     org.apache.catalina.util.ParameterMap
 * Java Class Version: 6 (50.0)
 * JD-Core Version:    0.5.3
 */