使用struts2框架后的拦截器

过滤特殊字符的过滤器

struts2会在web.xml中配置如下的过滤器：

<filter>
        <filter-name>struts</filter-name>
        <filter-class>
            org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
        </filter-class>
    </filter>

    <filter-mapping>
        <filter-name>struts</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

当自己需要再建一个过滤特殊字符的过滤器时，需要将自己的过滤器放在struts2的过滤器前边才会过滤掉使用struts2框架的路径，在web.xml中的整体配置：

    <!-- 过滤特殊字符 -->
    <filter>
        <filter-name>FilterSpecial</filter-name>
        <filter-class>com.piccsoft.project.security.auth.FilterSpecial</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>FilterSpecial</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- 过滤特殊字符 -->
    <filter>
        <filter-name>struts</filter-name>
        <filter-class>
            org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
        </filter-class>
    </filter>

    <filter-mapping>
        <filter-name>struts</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

具体的过滤器的写法如下：

 package com.project.security.auth;

 import java.io.IOException;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.regex.PatternSyntaxException;

 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.apache.commons.lang3.StringUtils;

 import com.core.util.excel.other.StringUtilTools;

 public class FilterSpecial  implements Filter {

     public void destroy() {

     }

     public void doFilter(ServletRequest request, ServletResponse response,
             FilterChain chain) throws IOException, ServletException {

         Map map=request.getParameterMap();
         Set keSet=map.entrySet();
         boolean bExist = false;
         String result="";

         for(Iterator itr=keSet.iterator();itr.hasNext();){
             Map.Entry me=(Map.Entry)itr.next();
             Object ok=me.getKey();
             if (StringFilter(ok.toString())){
                 bExist = true;
                 result=ok.toString();
                 break;
             }
             Object ov=me.getValue();

             String[] value=new String[1];
             if(ov instanceof String[]){
                 value=(String[])ov;
             }else{
                 value[0]=ov.toString();
             }

             for(int k=0;k<value.length;k++){
                 if (StringFilter(value[k])){
                     bExist = true;
                     result=value[k];
                     break;
                 }
             }
         }
         if(bExist){
             HttpServletRequest req = (HttpServletRequest) request;
             HttpServletResponse res = (HttpServletResponse) response;
             String [] tmp={"..","WEB-INF","\t","alert(","<",">","confirm("};
             String temp="";
             for(int i=0;i<tmp.length;i++){
                 temp=tmp[i];
                 int index=result.indexOf(temp);
                 if(index!=-1){
                     break;
                 }
             }
             req.setAttribute("result", temp);
             req.getRequestDispatcher("/error.jsp").forward(req,res);
         }else{
             chain.doFilter(request, response);
         }
     }

     public void init(FilterConfig arg0) throws ServletException {
         // TODO Auto-generated method stub
     } 

     public static boolean StringFilter(String str) throws PatternSyntaxException   {
          if(!StringUtils.isNotEmpty(str)) return false;

          str = str.replace("<br>", "").replace("<Br>", "").replace("<BR>", "");

          // 清除掉所有特殊字符
          String regEx="\\.\\.|WEB-INF|<|>|\t|alert\\(|confirm\\(";

          Pattern   p   =   Pattern.compile(regEx);
          Matcher   m   =   p.matcher(str);

          return   m.find();  

     }
 }