SpringMVC 过滤参数的非法字符

package com.oozero.nmshop.system.filter;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.web.filter.OncePerRequestFilter;

import com.oozero.nmshop.system.pojo.Employee;
import com.oozero.nmshop.system.util.JNConstant;

public class LoginSessionFilter extends OncePerRequestFilter {

private static final String[] ignores = new String[] { "/login.jsp", "resources", "base/user/login", "menu/init",
"/system/loginStatistics/addString", "mutilUpload" };

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {

request = new Request((HttpServletRequest) request);

response.setHeader("Set-Cookie", "name=value; HttpOnly");

String referer = request.getHeader("Referer"); // REFRESH
if (referer != null && referer.indexOf(request.getContextPath()) < 0) {

HttpServletResponse servletResponse = (HttpServletResponse) response;
HttpServletRequest servletRequest = (HttpServletRequest) request;

servletResponse.sendRedirect(servletRequest.getContextPath() + "/error.jsp");

} else {

// 获得在下面代码中要用的request,response,session对象
HttpServletRequest servletRequest = (HttpServletRequest) request;
HttpServletResponse servletResponse = (HttpServletResponse) response;
HttpSession session = servletRequest.getSession();

Employee employee = (Employee) session.getAttribute(JNConstant.LOGIN_SESSION);

String path = servletRequest.getRequestURI();

if (employee != null) {
chain.doFilter(servletRequest, servletResponse);
return;
}

// 登陆页面无需过滤
for (String s : ignores) {
if (path.indexOf(s) > -1) {
chain.doFilter(servletRequest, servletResponse);
return;
}
}
// 判断如果没有取到员工信息,就跳转到登陆页面

if (employee == null && (path.indexOf("admin") > -1 || path.indexOf("system") > -1)) {

String queryString="";
if(request.getQueryString()!=null){
queryString="?"+request.getQueryString();
}

// 跳转到登陆页面
servletResponse.sendRedirect(servletRequest.getContextPath() + "/login.jsp?url=http://"
+ servletRequest.getHeader("host") + path + queryString);
} else {
// 已经登陆,继续此次请求
chain.doFilter(request, response);
}

}

}

public String filterDangerString(String value) {
if (value == null) {
return null;
}
value = value.replaceAll("\\|", "");

value = value.replaceAll("&", "&");

value = value.replaceAll(";", "");

value = value.replaceAll("@", "");

value = value.replaceAll("'", "");

value = value.replaceAll(""", "");

value = value.replaceAll("\\'", "");

value = value.replaceAll("\\"", "");

value = value.replaceAll("<", "<");

value = value.replaceAll(">", ">");

value = value.replaceAll("\\(", "");

value = value.replaceAll("\\)", "");

value = value.replaceAll("\\+", "");

value = value.replaceAll("\r", "");

value = value.replaceAll("\n", "");

value = value.replaceAll("script", "");

value = value.replaceAll("'", "");
value = value.replaceAll(""", "");
value = value.replaceAll(">", "");
value = value.replaceAll("<", "");
value = value.replaceAll("=", "");
value = value.replaceAll("/", "");
return value;
}

class Request extends HttpServletRequestWrapper {
public Request(HttpServletRequest request) {
super(request);
}

@Override
public String getParameter(String name) {
// 返回值之前 先进行过滤
return filterDangerString(super.getParameter(name));
}

@Override
public String[] getParameterValues(String name) {
// 返回值之前 先进行过滤
String[] values = super.getParameterValues(name);
for (int i = 0; i < values.length; i++) {
values[i] = filterDangerString(values[i]);
}
return values;
}
}

}