在spring cloud 框架中添加过滤器，对json格式的请求数据进行过滤进行防sql注入（只对一层json有效）

请求数据json只能是一层，多层嵌套的json数据不支持，有大牛知道怎么解决的可以提出来，谢谢

 

/**

* 对请求json参数进行防sql注入过滤

*

* @create 2018-12-18

*/

@Component

@Slf4j

@RefreshScope

public class SqLinjectionFilter extends ZuulFilter {

@Override

public String filterType() {

return "pre";

}

 

@Override

public int filterOrder() {

return -3;

}

 

@Override

public boolean shouldFilter() {

return true;

}

 

@Override

public Object run() {

RequestContext ctx = RequestContext.getCurrentContext();

HttpServletRequest request = ctx.getRequest();

try {

InputStream in = ctx.getRequest().getInputStream();

String body = StreamUtils.copyToString(in, Charset.forName("UTF-8"));

Map<String, Object> stringObjectMap = cleanXSS(body);

JSONObject json = JSONObject.fromObject(stringObjectMap);

String newBody = json.toString();

final byte[] reqBodyBytes = newBody.getBytes();

ctx.setRequest(new HttpServletRequestWrapper(request){

@Override

public ServletInputStream getInputStream() throws IOException {

return new ServletInputStreamWrapper(reqBodyBytes);

}

@Override

public int getContentLength() {

return reqBodyBytes.length;

}

@Override

public long getContentLengthLong() {

return reqBodyBytes.length;

}

});

} catch (IOException e) {

e.printStackTrace();

}

return null;

}

private Map<String, Object> cleanXSS(String value) {

//You'll need to remove the spaces from the html entities below

value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");

value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");

value = value.replaceAll("'", "& #39;");

value = value.replaceAll("eval\\((.*)\\)", "");

value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

value = value.replaceAll("script", "");

value = value.replaceAll("[*]","["+"*]");

value = value.replaceAll("[+]","["+"+]");

value = value.replaceAll("[?]","["+"?]");

 

String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|%|chr|mid|master|truncate|" +

"char|declare|sitename|net user|xp_cmdshell|;|or|+|,|like'|and|exec|execute|insert|create|drop|" +

"table|from|grant|use|group_concat|column_name|" +

"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|" +

"chr|mid|master|truncate|char|declare|or|;|--|,|like|//|/|%|#";

JSONObject json = JSONObject.fromObject(value);

String[] badStrs = badStr.split("\\|");

Map<String, Object> map=json;

Map<String, Object> mapjson=new HashMap<>();

for (Map.Entry<String, Object> entry : map.entrySet()) {

String value1 = (String) entry.getValue();

for (String bad :badStrs){

if (value1.equalsIgnoreCase(bad)){

value1="forbid";

mapjson.put(entry.getKey(),value1);

break;

}else {

mapjson.put(entry.getKey(),entry.getValue());

}

}

}

return mapjson;

}

}