百度,google了半天即使再万能的stackoverflow上也没有得到解答,今天偶然间发现springmvc注解@RequestParam不是通过HttpServletRequest.java的getParameter(String name)方法得到的参数值,而是通过getParameterValues得到的,怪不得debug了半天getParameter方法就是未被调用,filter也没生效。
相关代码如下:
RequestFilter.java
01 |
package com.zuidaima.filter; |
03 |
import java.io.IOException; |
04 |
import java.io.UnsupportedEncodingException; |
06 |
import javax.servlet.FilterChain; |
07 |
import javax.servlet.ServletException; |
08 |
import javax.servlet.http.HttpServletRequest; |
09 |
import javax.servlet.http.HttpServletRequestWrapper; |
10 |
import javax.servlet.http.HttpServletResponse; |
12 |
import org.springframework.web.filter.OncePerRequestFilter; |
14 |
*@author
www.zuidaima.com |
16 |
public class RequestFilter extends OncePerRequestFilter
{ |
18 |
public String
filter(HttpServletRequest request, String input) { |
21 |
if (input
== null ||
input.trim().equals("(null)"))
{ |
25 |
final String
userAgent = request.getHeader("User-Agent"); |
26 |
final String
method = request.getMethod(); |
28 |
if (method.equalsIgnoreCase("get") |
29 |
||
userAgent.toLowerCase().indexOf("android")
!= -1)
{ |
31 |
ret
= new String(input.getBytes("ISO8859-1"), "utf-8"); |
32 |
} catch (UnsupportedEncodingException
e) { |
40 |
protected void doFilterInternal(final HttpServletRequest
request, |
41 |
HttpServletResponse
response, FilterChain chain) |
42 |
throws ServletException,
IOException { |
44 |
chain.doFilter(new HttpServletRequestWrapper(request)
{ |
46 |
public String
getParameter(String name) { |
47 |
String
value = super.getParameter(name); |
48 |
return filter(this,
value); |
52 |
public String[]
getParameterValues(String name) { |
53 |
String[]
values = super.getParameterValues(name); |
57 |
for (int i
= 0;
i < values.length; i++) { |
58 |
values[i]
= filter(this,
values[i]); |
当然必须在web.xml中配置启动该过滤器:
2 |
<filter-name>RequestFilter</filter-name> |
3 |
<filter-class>com.zuidaima.filter.RequestFilter</filter-class> |
6 |
<filter-name>RequestFilter</filter-name> |
7 |
<url-pattern>*.htm</url-pattern> |
这样就可以实现全局的控制springmvc的参数过滤,比如xss,编解码等业务,比在每个springmvc方法中对每个参数值进行判断和过滤简单方便多了。