java web 敏感字符过滤器

最新推荐文章于 2023-06-20 21:55:06 发布

tonfay

最新推荐文章于 2023-06-20 21:55:06 发布

阅读量628

点赞数

CC 4.0 BY-SA版权

分类专栏： java 文章标签： java

本文链接：https://blog.youkuaiyun.com/tengfei_0812/article/details/51732816

java 专栏收录该内容

8 篇文章

订阅专栏

本文介绍了一种用于防止SQL注入攻击的过滤器实现方法。该过滤器通过正则表达式匹配请求参数中的敏感字符，并将其替换为指定字符串，从而有效避免SQL注入风险。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

public class ParamsFilter implements Filter {
/** 敏感字符 */
String regEx="(SELECT|select)";

/** 替换字符串 */
String replaceStr = "**";

@Override
public void destroy() {
// TODO Auto-generated method stub

}

@Override
public void doFilter(ServletRequest arg0, ServletResponse arg1,
FilterChain chain) throws IOException, ServletException {
// TODO Auto-generated method stub
Pattern p = Pattern.compile(regEx);
HttpServletRequest request = (HttpServletRequest) arg0;
HashMap paramterMap = new HashMap(request.getParameterMap());

/** 过滤敏感字符 */
Enumeration enu = request.getParameterNames();
while(enu.hasMoreElements()){
String paraName = (String)enu.nextElement();
if(paramterMap.get(paraName) != null){
try {
String vs[] = (String[]) paramterMap.get(paraName);
for(int i = 0;i < vs.length ; i++){
String v = vs[i];
if(v != null ) v = v.toLowerCase();
Matcher m = p.matcher(v);
v = m.replaceAll(replaceStr).trim();
vs[i] = v;
}
paramterMap.put(paraName, vs);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

}
ParameterRequestWrapper wrapRequest=new ParameterRequestWrapper(request , paramterMap);
chain.doFilter(wrapRequest, arg1);
}

@Override
public void init(FilterConfig arg0) throws ServletException {
// TODO Auto-generated method stub

}

}

public class ParameterRequestWrapper extends HttpServletRequestWrapper {
private Map params;

public ParameterRequestWrapper(HttpServletRequest request, Map newParams) {
super(request);
this.params = newParams;
// TODO Auto-generated constructor stub
}

public Map getParameterMap() {
return params;
}

public Enumeration getParameterNames() {
Vector l = new Vector(params.keySet());
return l.elements();
}

public String[] getParameterValues(String name) {
Object v = params.get(name);
if (v == null) {
return null;
} else if (v instanceof String[]) {
return (String[]) v;
} else if (v instanceof String) {
return new String[] { (String) v };
} else {
return new String[] { v.toString() };
}
}

public String getParameter(String name) {
Object v = params.get(name);
if (v == null) {
return null;
} else if (v instanceof String[]) {
String[] strArr = (String[]) v;
if (strArr.length > 0) {
return strArr[0];
} else {
return null;
}
} else if (v instanceof String) {
return (String) v;
} else {
return v.toString();
}
}

}