【Spring-boot】使用filter对request body参数进行校验

最新推荐文章于 2025-03-10 17:24:09 发布

zhzhsxx

最新推荐文章于 2025-03-10 17:24:09 发布

阅读量8.9k

点赞数

分类专栏： Java spring-boot

本文链接：https://blog.youkuaiyun.com/u012661496/article/details/83653206

版权

Java 同时被 2 个专栏收录

29 篇文章

订阅专栏

spring-boot

9 篇文章

订阅专栏

本文介绍了一种在Java Web应用中实现参数检查的过滤器，通过重写HttpServletRequest的方法，缓存并清理请求体中的参数，确保参数的有效性和安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

@Slf4j
public class ParameterCheckServletRequestWrapper extends HttpServletRequestWrapper {
    private byte[] requestBody;
    private Charset charSet;

    public ParameterCheckServletRequestWrapper(HttpServletRequest request) {
        super(request);

        //缓存请求body
        try {
            String requestBodyStr = getRequestPostStr(request);
            if (StringUtils.isNotBlank(requestBodyStr)) {
                JSONObject resultJson = JSONObject.fromObject(requestBodyStr.replace("\"", "'"));

                Object[] obj = resultJson.keySet().toArray();
                for (Object o : obj) {
                    resultJson.put(o, StringUtils.trimToNull(resultJson.get(o).toString()));
                }

                requestBody = resultJson.toString().getBytes(charSet);
            } else {
                requestBody = new byte[0];
            }
        } catch (IOException e) {
            log.error("", e);
        }
    }

    public String getRequestPostStr(HttpServletRequest request)
            throws IOException {
        String charSetStr = request.getCharacterEncoding();
        if (charSetStr == null) {
            charSetStr = "UTF-8";
        }
        charSet = Charset.forName(charSetStr);

        return StreamUtils.copyToString(request.getInputStream(), charSet);
    }

    /**
     * 重写 getInputStream()
     */
    @Override
    public ServletInputStream getInputStream() {
        if (requestBody == null) {
            requestBody = new byte[0];
        }

        final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(requestBody);

        return new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }

            @Override
            public int read() {
                return byteArrayInputStream.read();
            }
        };
    }

    /**
     * 重写 getReader()
     */
    @Override
    public BufferedReader getReader() {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

}

public class ParameterCheckFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        ParameterCheckServletRequestWrapper myWrapper = new ParameterCheckServletRequestWrapper((HttpServletRequest) servletRequest);
        filterChain.doFilter(myWrapper, servletResponse);
    }

    @Override
    public void destroy() {

    }
}

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean authFilterRegistrationBean() {
        FilterRegistrationBean<Filter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setName("parameterCheckFilter");
        registrationBean.setFilter(new ParameterCheckFilter());
        registrationBean.setOrder(1);
        registrationBean.addUrlPatterns("/*");
        return registrationBean;
    }

}