filter修改post参数

　　前景：公司项目web渗透测试中提出管理登录时，传输密码不能为明文，需要加密传输，但是迫于系统架构，后端代码不能修改，只能在filter中解密参数。

　　1.前端加密处理：

 <script type="text/javascript">
     $(function() {
         $("#loginBtn").click(function() {
             //对数据加密
             var password = encode64($("#pwdInput").val());
             $("#pwdInput").val(password);
             document.login.submit();  //login为form表单name
         })
     })
     // base64加密开始
     var keyStr = "ABCDEFGHIJKLMNOP" + "QRSTUVWXYZabcdef" + "ghijklmnopqrstuv"   + "wxyz0123456789+/" + "=";
     function encode64(input) {
         var output = "";
         var chr1, chr2, chr3 = "";
         var enc1, enc2, enc3, enc4 = "";
         var i = 0;
         do {
             chr1 = input.charCodeAt(i++);
             chr2 = input.charCodeAt(i++);
             chr3 = input.charCodeAt(i++);
             enc1 = chr1 >> 2;
             enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
             enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
             enc4 = chr3 & 63;
             if (isNaN(chr2)) {
                 enc3 = enc4 = 64;
             } else if (isNaN(chr3)) {
                 enc4 = 64;
             }
             output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2)     + keyStr.charAt(enc3) + keyStr.charAt(enc4);
             chr1 = chr2 = chr3 = "";
             enc1 = enc2 = enc3 = enc4 = "";
         } while (i < input.length);
         return output;
     } // base64加密结束
 </script>

　　2.后端解密：

 　　private static byte[] base64DecodeChars = new byte[] { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
             -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
             -1, 62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, -1, 0, 1, 2, 3, 4,
             5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26,
             27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1,
             -1, -1, -1 };

     /** * 解密 * @param str * @return */
     public static byte[] decode(String str) {
         byte[] data = str.getBytes();
         int len = data.length;
         ByteArrayOutputStream buf = new ByteArrayOutputStream(len);
         int i = 0;
         int b1, b2, b3, b4;
         while (i < len) {
             do {
                 b1 = base64DecodeChars[data[i++]];
             } while (i < len && b1 == -1);
             if (b1 == -1) {
                 break;
             }
             do {
                 b2 = base64DecodeChars[data[i++]];
             } while (i < len && b2 == -1);
             if (b2 == -1) {
                 break;
             }
             buf.write((int) ((b1 << 2) | ((b2 & 0x30) >>> 4)));
             do {
                 b3 = data[i++];
                 if (b3 == 61) {
                     return buf.toByteArray();
                 }
                 b3 = base64DecodeChars[b3];
             } while (i < len && b3 == -1);
             if (b3 == -1) {
                 break;
             }
             buf.write((int) (((b2 & 0x0f) << 4) | ((b3 & 0x3c) >>> 2)));
             do {
                 b4 = data[i++];
                 if (b4 == 61) {
                     return buf.toByteArray();
                 }
                 b4 = base64DecodeChars[b4];
             } while (i < len && b4 == -1);
             if (b4 == -1) {
                 break;
             }
             buf.write((int) (((b3 & 0x03) << 6) | b4));
         }
         return buf.toByteArray();
     }

　　3.filter修改post参数值

　　　　3.1修改filter

 　　         MyHttpServletRequestWrapper requestWrapper = new MyHttpServletRequestWrapper(request);
             String captcha = (String) requestWrapper.getParameter("captcha");
             log.debug("filter get captcha:" + captcha);
             if (StringUtil.isNotNull(captcha)
                     && captcha.equalsIgnoreCase("" + request.getSession().getAttribute("captcha"))) {
                 captcha = QueryCaptchaUtil.QueryCaptcha();
                 session.removeAttribute("captcha"); // 验证码登录后销毁
                 session.setAttribute("captcha", captcha);
                 certService.setCertProperty(request);
                 // 1.获取需要处理的参数
                 String userPassword = requestWrapper.getParameter("userPassword");                 // 2.把处理后的参数放回去
                 requestWrapper.setParameter("userPassword", new String(decode(userPassword)));
                 // 3.放行，把我们的requestWrapper放到方法当中
                 chain.doFilter(requestWrapper, response);
                 return;
             }

　　　　3.2 MyHttpServletRequestWrapper.java

 import java.io.BufferedReader;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;

 import javax.servlet.ReadListener;
 import javax.servlet.ServletInputStream;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;

 /**
  * 重写 HttpServletRequestWrapper 处理表单、ajax请求
  *
  * @author dongzhihao
  *
  */
 public class MyHttpServletRequestWrapper extends HttpServletRequestWrapper {

     //private final byte[] body;

     // 用于存储请求参数
     private Map<String, Object> params = new HashMap<String, Object>();

     // 构造方法
     public MyHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
         super(request);
         //body = parseBodyToBytes(request);
         // 把请求参数添加到我们自己的map当中
         this.params.putAll(request.getParameterMap());
     }

     @Override
     public String getQueryString() {
         StringBuffer buffer = new StringBuffer();
         Set<String> keySet = params.keySet();
         int i = 0;
         for (Iterator<String> iterator = keySet.iterator(); iterator.hasNext();) {
             if (i != 0) {
                 buffer.append("&");
             }
             String key = (String) iterator.next();
             Object obj = params.get(key);
             if (obj instanceof String[]) {
                 String[] new_name = (String[]) obj;
                 obj=new_name[0];
             }
             buffer.append(key + "=").append(obj);
             i++;
         }
         System.out.println(buffer.toString());
         return buffer.toString();
     }

     /**
      * 添加参数到map中
      *
      * @param name
      * @param value
      */
     public void setParameter(String name, Object value) {
         if (value != null) {
             System.out.println(value);
             if (value instanceof String[]) {
                 params.put(name, (String[]) value);
             } else if (value instanceof String) {
                 params.put(name, value);
             } else {
                 params.put(name, new String[] { String.valueOf(value) });
             }
         }
     }

     @Override
     public BufferedReader getReader() throws IOException {
         return new BufferedReader(new InputStreamReader(getInputStream()));
     }

     @Override
     public ServletInputStream getInputStream() throws IOException {
         final ByteArrayInputStream bais = new ByteArrayInputStream(getQueryString().getBytes());
         return new ServletInputStream() {
             @Override
             public int read() throws IOException {
                 return bais.read();
             }

             @Override
             public boolean isFinished() {
                 return false;
             }

             @Override
             public boolean isReady() {
                 return false;
             }

             @Override
             public void setReadListener(ReadListener arg0) {
             }
         };
     }

 }