Java struts2 拦截器 interceptors

最新推荐文章于 2025-04-11 02:15:00 发布

weixin_34352449

最新推荐文章于 2025-04-11 02:15:00 发布

阅读量110

点赞数

CC 4.0 BY-SA版权

文章标签： python java

原文链接：https://my.oschina.net/u/1011854/blog/761608

本文介绍了一种特殊字符拦截器的设计与实现，该拦截器能够有效防止SQL注入攻击。通过检查HTTP请求参数中的非法字符，并利用拦截器栈进行多层次的安全防护。

2019独角兽企业重金招聘Python工程师标准>>>

拦截器类如下所示：

import java.io.PrintWriter;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.apache.struts2.ServletActionContext;

import com.edp.org.user.vo.User;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.ActionSupport;
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;

/**
 * 特殊字符拦截器
 * 
 * @author zhangda
 *
 */
public class SpecialCharInterceptor extends AbstractInterceptor {

	Logger logger = Logger.getLogger(this.getClass());

	/**
	 * 拦截方法
	 * 
	 */
	public String intercept(ActionInvocation invocation) throws Exception {

		// 取得ActionContext实例
		ActionContext ctx = invocation.getInvocationContext();
		
		//先验证是否传入非法字符，以防sql注入 --张达 20151216
		String msg = validateDataBaseSpecialChar(ctx);
		if(!msg.equals("")){
			logger.error("参数传入非法字符！");
			HttpServletResponse response = ServletActionContext.getResponse();
			response.setHeader("Content-type", "text/html;charset=UTF-8");  
			response.setCharacterEncoding("utf-8");
	        PrintWriter out = response.getWriter();
	        out.print("{\"success\": false, \"errMsg\": \"参数传入非法字符\"}"); 
	        out.flush();
	        out.close();
			return ActionSupport.ERROR;
		}else{
			return invocation.invoke();
		}
		
	}
	
	/***
	 * 过滤sql注入的特殊字符 zd
	 * @param ac
	 * @return
	 */
	public String validateDataBaseSpecialChar(ActionContext ac) {  
        Map<String, Object> inputMap = ac.getParameters();  
        //查询字典请求需要传入特殊字符
        if(ac.getContext().getName().equals("getDictionaryByTypeIds")){
        	return "";
        }else{
        	Iterator<Entry<String, Object>> it = inputMap.entrySet().iterator();  
            while (it.hasNext()) {  
                Map.Entry<String, Object> entry = it.next();  
                Object value = entry.getValue();  
                if  (value instanceof String[]) { 
                	String[] valueArray = (String[])value;
                	String valueStr = "";
                	if(valueArray != null && valueArray.length != 0){
                		for(int i=0; i<valueArray.length; i++){
                			valueStr += valueArray[0] + ",";
                    	}
                	}
                	return checkInject(valueStr);
                } 
            }  
        }
        
        return "";
    } 
	
	//防sql注入的字符串数组
	private static final String[] INJ_STR = {
		"exec ", "select ", "insert ", "update " , "delete", "count ", "master ", "drop ",
		"truncate ", "declare ", " or ", " and ", "--", "'", "\"", "\'", "\\\"", "(", ")", ";", "--", "+"
	};
	
	private static String checkInject(String str)  {
		
		for (int i=0; i<INJ_STR.length; i++) {
			if (str.toLowerCase().indexOf(INJ_STR[i]) > -1) {
				return "error";
			}
		}
		return "";
	}
}

struts配置文件如下：

<!-- 配置拦截器  用于拦截防止sql注入的特殊字符-->
		<interceptors>
			<interceptor name="SpecialCharInter" class="com.edp.web.SpecialCharInterceptor"></interceptor>
			<!-- 配置userSessionStack拦截器栈 -->
			<interceptor-stack name="SpecialCharStack">
				<interceptor-ref name="SpecialCharInter"></interceptor-ref>
				<interceptor-ref name="defaultStack"></interceptor-ref>
			</interceptor-stack>
		</interceptors>
		<default-interceptor-ref name="SpecialCharStack"></default-interceptor-ref>

转载于:https://my.oschina.net/u/1011854/blog/761608