java pathinfo_request.getPathInfo();

本文介绍了Java中request.getPathInfo()方法,该方法返回请求的实际URL相对于请求的servlet的url的路径,且不返回查询字符串。还举例说明了如何利用该方法实现多用户博客系统的URL,通过在servlet里调用此方法获取用户名,再从数据库查询相应数据。

request.getPathInfo();

这个方法返回请求的实际URL相对于请求的serlvet的url的路径。(个人理解。)

比如,有一个Servlet的映射是这样配置的:

TestServlet

/servlet/test/*

为servlet配置的访问路径是:/servlet/test/*

我只要访问:

http://localhost:8080/dwr/servlet/test/这里可以是任何东西

就可以访问那个servlet. dwr 是项目的名字

比如,我用这个 URL 来访问它:

http://localhost:8080/dwr/servlet/test/joejoe1991/a.html

这个实际的URL,相对于那个servlet 的url ("/servlet/test/*")的路径是:

/joejoe1991/a.html

所以 request.getPathInfo() 方法返回的就是:

"/joejoe1991/a.html"

如果你的URL里有查询字符串,getPathInfo() 方法并不返回这些查询字符串。

例如:

http://localhost:8080/dwr/servlet/test/joejoe1991/a.html?name=test

getPathInfo() 返回的仍然是:

"/joejoe1991/a.html" ,而并不包括后面的"?name=test"

我们可以利用这个方法去做类似于多用户博客系统的那种URL。

都是http://www.xxx.com/blog/ 开头

后面跟的是用户名,

比如我要访问joejoe1991的博客:

http://www.xxx.com/blog/joejoe1991

这个joejoe1991并不是一个真实存在的目录。

建一个servlet,配置路径为:/blog/*

然后在这个servlet里调用request.getPathInfo() 方法。

比如:http://www.xxx.com/blog/jjx

那request.getPathInfo() 方法返回的就是jjx ,表示要访问jjx的博客。

这时再去数据库里查相应的数据就好。

// src/main/java/com/example/diary/servlet/DiaryServlet.java package com.example.diary.servlet; import com.example.diary.dao.DiaryDao; import com.example.diary.model.Diary; import com.example.diary.util.JsonUtil; import com.google.gson.Gson; import com.google.gson.JsonObject; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.io.PrintWriter; import java.sql.SQLException; import java.util.Date; import java.util.List; @WebServlet("/api/diaries/*") public class DiaryServlet extends HttpServlet { private DiaryDao diaryDao; private Gson gson; @Override public void init() throws ServletException { super.init(); diaryDao = new DiaryDao(); gson = new Gson(); } @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String pathInfo = req.getPathInfo(); if (pathInfo == null || pathInfo.equals("/")) { // 获取日记列表 int page = req.getParameter("page") != null ? Integer.parseInt(req.getParameter("page")) : 1; int size = req.getParameter("size") != null ? Integer.parseInt(req.getParameter("size")) : 10; String searchType = req.getParameter("searchType") != null ? req.getParameter("searchType") : "title"; String searchQuery = req.getParameter("searchQuery") != null ? req.getParameter("searchQuery") : ""; try { List<Diary> diaries = diaryDao.getAllDiaries(page, size, searchType, searchQuery); int total = diaryDao.getTotalCount(searchType, searchQuery); JsonObject responseJson = new JsonObject(); responseJson.add("list", gson.toJsonTree(diaries)); responseJson.addProperty("total", total); sendJsonResponse(resp, responseJson.toString()); } catch (SQLException e) { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Database error"); } } else { // 获取单个日记 String[] splits = pathInfo.split("/"); if (splits.length != 2) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid URL"); return; } String diaryId = splits[1]; try { Diary diary = diaryDao.getDiaryById(Integer.parseInt(diaryId)); if (diary != null) { sendJsonResponse(resp, gson.toJson(diary)); } else { sendErrorResponse(resp, HttpServletResponse.SC_NOT_FOUND, "Diary not found"); } } catch (NumberFormatException e) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid diary ID"); } catch (SQLException e) { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Database error"); } } } @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { try { Diary diary = JsonUtil.parseJsonRequest(req, Diary.class); diary.setCreateTime(new Date()); diary.setUpdateTime(new Date()); int id = diaryDao.createDiary(diary); diary.setId(id); resp.setStatus(HttpServletResponse.SC_CREATED); sendJsonResponse(resp, gson.toJson(diary)); } catch (Exception e) { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Error creating diary"); } } @Override protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String pathInfo = req.getPathInfo(); if (pathInfo == null || pathInfo.equals("/")) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Missing diary ID"); return; } String[] splits = pathInfo.split("/"); if (splits.length != 2) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid URL"); return; } String diaryId = splits[1]; try { Diary existingDiary = diaryDao.getDiaryById(Integer.parseInt(diaryId)); if (existingDiary == null) { sendErrorResponse(resp, HttpServletResponse.SC_NOT_FOUND, "Diary not found"); return; } Diary diary = JsonUtil.parseJsonRequest(req, Diary.class); diary.setId(Integer.parseInt(diaryId)); diary.setCreateTime(existingDiary.getCreateTime()); diary.setUpdateTime(new Date()); boolean updated = diaryDao.updateDiary(diary); if (updated) { sendJsonResponse(resp, gson.toJson(diary)); } else { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Failed to update diary"); } } catch (NumberFormatException e) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid diary ID"); } catch (SQLException e) { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Database error"); } } @Override protected void doDelete(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String pathInfo = req.getPathInfo(); if (pathInfo == null || pathInfo.equals("/")) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Missing diary ID"); return; } String[] splits = pathInfo.split("/"); if (splits.length != 2) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid URL"); return; } String diaryId = splits[1]; try { boolean deleted = diaryDao.deleteDiary(Integer.parseInt(diaryId)); if (deleted) { resp.setStatus(HttpServletResponse.SC_NO_CONTENT); } else { sendErrorResponse(resp, HttpServletResponse.SC_NOT_FOUND, "Diary not found"); } } catch (NumberFormatException e) { sendErrorResponse(resp, HttpServletResponse.SC_BAD_REQUEST, "Invalid diary ID"); } catch (SQLException e) { sendErrorResponse(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Database error"); } } private void sendJsonResponse(HttpServletResponse resp, String json) throws IOException { resp.setContentType("application/json"); resp.setCharacterEncoding("UTF-8"); PrintWriter out = resp.getWriter(); out.print(json); out.flush(); } private void sendErrorResponse(HttpServletResponse resp, int statusCode, String message) throws IOException { resp.setStatus(statusCode); resp.setContentType("application/json"); resp.setCharacterEncoding("UTF-8"); JsonObject errorResponse = new JsonObject(); errorResponse.addProperty("error", message); PrintWriter out = resp.getWriter(); out.print(gson.toJson(errorResponse)); out.flush(); } }
06-11
/** * XSS过滤处理 * * @author ruoyi */ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { /** * @param request */ public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); } @Override public String[] getParameterValues(String name) { String[] values = super.getParameterValues(name); if (values != null) { int length = values.length; String[] escapseValues = new String[length]; for (int i = 0; i < length; i++) { // 防xss攻击和过滤前后空格 escapseValues[i] = EscapeUtil.clean(values[i]).trim(); } return escapseValues; } return super.getParameterValues(name); } // 安全处理路径方法 @Override public String getRequestURI() { String uri = super.getRequestURI(); return uri != null ? sanitizePath(uri) : null; } @Override public String getPathInfo() { String pathInfo = super.getPathInfo(); // 关键修复:正确处理 null return pathInfo != null ? sanitizePath(pathInfo) : null; } @Override public String getServletPath() { String path = super.getServletPath(); return path != null ? sanitizePath(path) : null; } // 更安全的清理方法 private String sanitizePath(String path) { if (path == null || path.isEmpty()) { return path; } // 1. 移除基础危险字符 String cleaned = path.replaceAll("[<>\"']", ""); // 2. 移除JavaScript事件处理器 cleaned = cleaned.replaceAll("(?i)on\\w+\\s*=", ""); // 3. 移除危险函数调用 cleaned = cleaned.replaceAll("(?i)javascript\\s*:", ""); return cleaned; } }现在这样能避免问题吗
最新发布
08-06
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符  | 博主筛选后可见
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值