HttpServletRequestWrapper的使用
2016-11-22 16:00
344 查看
老大给了一个很实际的需求：有段程序，使用Http的方式与合作商交互，而且是明文传输数据。我方的代码已经打包放在服务器上运行了很长时间，这时合作商突然要求修改数据传输的方式，要求加密后再传输，而我方的原有的代码不能改变，以防止引发其它问题。
问：如何在不修改我方现有的代码的前提下，满足合作商的要求？
可能大家都想到了，只要加上一个过滤器Filter不就可以了吗？事实就是这样的，采用Filter+HttpServletRequestWrapper就可以解决这个问题。
首先：在filter中拦截到加密后的请求，将参数解密，然后组装成一个新的明文请求串。
然后：重写HttpServletRequestWrapper中的getInputStream()方法，让其返回过滤器解析后的明文串即可。
具体代码解释如下。
首先我写了两个一摸一样的servlet，一个用来直接接收合作商的明文请求并打印；一个用来接收Filter处理后的合作商的请求并打印（Filter中将合作商加密后的参数解密再传给这个Servlet）。
Java代码
@WebServlet("/SiServlet")
public class SiServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public SiServlet() {
super();
}
/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
* response)
*
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
System.out.println("SiServlet接收到请求为: " + bizBindMsg);
response.getWriter().write("==========success=========");
}
}
Java代码
@WebServlet("/SiServletNormal")
public class SiServletNormal extends HttpServlet {
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public SiServletNormal() {
super();
}
/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
* response)
*
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
System.out.println("SiServletNormal接收到请求为: " + bizBindMsg);
response.getWriter()
.write("==========SiServletNormal Success=========");
}
}
然后我使用HttpClient模拟了一下合作商发送明文和密文请求的过程，加密使用Base64简单模拟一下。
Java代码
public class AdcClient {
private HttpPost httpPost = null;
private HttpClient client = null;
private List<NameValuePair> pairs = null;
public AdcClient() {
httpPost = new HttpPost("http://localhost:8080/filtertest/SiServlet");
client = new DefaultHttpClient();
}
/**
* 发送明文消息
*
*/
public void sendMsg() {
try {
httpPost = new HttpPost(
"http://localhost:8080/filtertest/SiServletNormal");
pairs = new ArrayList<NameValuePair>();
pairs.add(new BasicNameValuePair(("param1"), "obama没加密"));
pairs.add(new BasicNameValuePair(("param2"), "男没加密"));
pairs.add(new BasicNameValuePair(("param3"), "汉没加密"));
pairs.add(new BasicNameValuePair(("param4"), "山东没加密"));
httpPost.setEntity(new UrlEncodedFormEntity(pairs, "UTF-8"));
// httpPost.setHeader("Cookie", "TOKEN=1234567890");
HttpResponse response = client.execute(httpPost);
HttpEntity entity = response.getEntity();
BufferedReader br = new BufferedReader(new InputStreamReader(
entity.getContent()));
String line = null;
StringBuffer result = new StringBuffer();
while ((line = br.readLine()) != null) {
result.append(line);
line = br.readLine();
}
System.out.println("来自SiServletNormal的响应为:" + result.toString());
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* 发送加密后的消息
*/
public void sendEncryptMsg() {
try {
pairs = new ArrayList<NameValuePair>();
pairs.add(new BasicNameValuePair(("param1"), Base64EnDecrypt
.base64Encode("obama")));
pairs.add(new BasicNameValuePair(("param2"), Base64EnDecrypt
.base64Encode("男")));
pairs.add(new BasicNameValuePair(("param3"), Base64EnDecrypt
.base64Encode("汉")));
pairs.add(new BasicNameValuePair(("param4"), Base64EnDecrypt
.base64Encode("山东")));
HttpEntity reqEntity = new UrlEncodedFormEntity(pairs, "UTF-8");
httpPost.setEntity(reqEntity);
// httpPost.setHeader("Cookie", "TOKEN=1234567890");
HttpResponse response = client.execute(httpPost);
/**
* 获取响应信息
*/
HttpEntity entity = response.getEntity();
BufferedReader br = new BufferedReader(new InputStreamReader(
entity.getContent()));
String line = null;
StringBuffer result = new StringBuffer();
while ((line = br.readLine()) != null) {
result.append(line);
line = br.readLine();
}
System.out.println("来自SiServlet的响应为:" + result.toString());
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* @param args
* @throws UnsupportedEncodingException
*/
public static void main(String[] args) throws UnsupportedEncodingException {
new AdcClient().sendMsg();
new AdcClient().sendEncryptMsg();
}
}
重点是下面的这个HttpServletRequestWrapper，我重写了它的getInputStream()方法，这个方法返回包含明文的ServletInputStream
Java代码
public class MyRequestWrapper extends HttpServletRequestWrapper {
private HttpServletRequest request;
public MyRequestWrapper(HttpServletRequest request) {
super(request);
this.request = request;
}
/**
* 先解密，获取明文；然后将明文转化为字节数组；然后再去读取字节数组中的内容
*/
@Override
public ServletInputStream getInputStream() {
String bizBindMsg = null;
ServletInputStream stream = null;
try {
stream = request.getInputStream();
bizBindMsg = IOUtils.toString(stream, "UTF-8");
} catch (IOException e) {
e.printStackTrace();
}
try {
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
System.out.println("MyRequestWrapper接收到的请求为: " + bizBindMsg);
/**
* 获取加密的值进行解密
*/
final StringBuffer reqStr = new StringBuffer();
reqStr.append("param1=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param1=") + 7,
bizBindMsg.indexOf("param2="))));
reqStr.append("&");
reqStr.append("param2=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param2=") + 7,
bizBindMsg.indexOf("param3="))));
reqStr.append("&");
reqStr.append("param3=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param3=") + 7,
bizBindMsg.indexOf("param4="))));
reqStr.append("&");
reqStr.append("param4=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(bizBindMsg
.indexOf("param4=") + 7)));
System.out.println("********MyRequestWrapper接收到的解密后的请求为*********");
System.out.println(reqStr.toString());
/**
* 将解密后的明文串放到buffer数组中
*/
byte[] buffer = null;
try {
buffer = reqStr.toString().getBytes("UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);
ServletInputStream newStream = new ServletInputStream() {
@Override
public int read() throws IOException {
return bais.read();
}
};
return newStream;
}
}
最后是简单的Filter，在这里将加密后的ServletRequest重新包装，交给SiServlet进行处理
Java代码
public class EncryptFilter implements Filter {
@Override
public void destroy() {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
chain.doFilter(new MyRequestWrapper((HttpServletRequest) request),
response);
}
@Override
public void init(FilterConfig arg0) throws ServletException {
}
}
我的web.xml中是这样配置的
Java代码
<filter>
<filter-name>encryptFilter</filter-name>
<filter-class>com.test.filter.EncryptFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>encryptFilter</filter-name>
<url-pattern>/SiServlet</url-pattern>
</filter-mapping>
确保过滤器entyptFilter只拦截到SiServlet的请求即可。
运行AdcClient，可以看到下面的结果
这里的重点是MyRequestWrapper中重写的getInputStream()方法。大家可以看看API中关于HttpServletRequest的用法http://tomcat.apache.org/tomcat-5.5-doc/servletapi/index.html。
问：如何在不修改我方现有的代码的前提下，满足合作商的要求？
可能大家都想到了，只要加上一个过滤器Filter不就可以了吗？事实就是这样的，采用Filter+HttpServletRequestWrapper就可以解决这个问题。
首先：在filter中拦截到加密后的请求，将参数解密，然后组装成一个新的明文请求串。
然后：重写HttpServletRequestWrapper中的getInputStream()方法，让其返回过滤器解析后的明文串即可。
具体代码解释如下。
首先我写了两个一摸一样的servlet，一个用来直接接收合作商的明文请求并打印；一个用来接收Filter处理后的合作商的请求并打印（Filter中将合作商加密后的参数解密再传给这个Servlet）。
Java代码
@WebServlet("/SiServlet")
public class SiServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public SiServlet() {
super();
}
/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
* response)
*
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
System.out.println("SiServlet接收到请求为: " + bizBindMsg);
response.getWriter().write("==========success=========");
}
}
Java代码
@WebServlet("/SiServletNormal")
public class SiServletNormal extends HttpServlet {
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public SiServletNormal() {
super();
}
/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
* response)
*
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
System.out.println("SiServletNormal接收到请求为: " + bizBindMsg);
response.getWriter()
.write("==========SiServletNormal Success=========");
}
}
然后我使用HttpClient模拟了一下合作商发送明文和密文请求的过程，加密使用Base64简单模拟一下。
Java代码
public class AdcClient {
private HttpPost httpPost = null;
private HttpClient client = null;
private List<NameValuePair> pairs = null;
public AdcClient() {
httpPost = new HttpPost("http://localhost:8080/filtertest/SiServlet");
client = new DefaultHttpClient();
}
/**
* 发送明文消息
*
*/
public void sendMsg() {
try {
httpPost = new HttpPost(
"http://localhost:8080/filtertest/SiServletNormal");
pairs = new ArrayList<NameValuePair>();
pairs.add(new BasicNameValuePair(("param1"), "obama没加密"));
pairs.add(new BasicNameValuePair(("param2"), "男没加密"));
pairs.add(new BasicNameValuePair(("param3"), "汉没加密"));
pairs.add(new BasicNameValuePair(("param4"), "山东没加密"));
httpPost.setEntity(new UrlEncodedFormEntity(pairs, "UTF-8"));
// httpPost.setHeader("Cookie", "TOKEN=1234567890");
HttpResponse response = client.execute(httpPost);
HttpEntity entity = response.getEntity();
BufferedReader br = new BufferedReader(new InputStreamReader(
entity.getContent()));
String line = null;
StringBuffer result = new StringBuffer();
while ((line = br.readLine()) != null) {
result.append(line);
line = br.readLine();
}
System.out.println("来自SiServletNormal的响应为:" + result.toString());
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* 发送加密后的消息
*/
public void sendEncryptMsg() {
try {
pairs = new ArrayList<NameValuePair>();
pairs.add(new BasicNameValuePair(("param1"), Base64EnDecrypt
.base64Encode("obama")));
pairs.add(new BasicNameValuePair(("param2"), Base64EnDecrypt
.base64Encode("男")));
pairs.add(new BasicNameValuePair(("param3"), Base64EnDecrypt
.base64Encode("汉")));
pairs.add(new BasicNameValuePair(("param4"), Base64EnDecrypt
.base64Encode("山东")));
HttpEntity reqEntity = new UrlEncodedFormEntity(pairs, "UTF-8");
httpPost.setEntity(reqEntity);
// httpPost.setHeader("Cookie", "TOKEN=1234567890");
HttpResponse response = client.execute(httpPost);
/**
* 获取响应信息
*/
HttpEntity entity = response.getEntity();
BufferedReader br = new BufferedReader(new InputStreamReader(
entity.getContent()));
String line = null;
StringBuffer result = new StringBuffer();
while ((line = br.readLine()) != null) {
result.append(line);
line = br.readLine();
}
System.out.println("来自SiServlet的响应为:" + result.toString());
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* @param args
* @throws UnsupportedEncodingException
*/
public static void main(String[] args) throws UnsupportedEncodingException {
new AdcClient().sendMsg();
new AdcClient().sendEncryptMsg();
}
}
重点是下面的这个HttpServletRequestWrapper，我重写了它的getInputStream()方法，这个方法返回包含明文的ServletInputStream
Java代码
public class MyRequestWrapper extends HttpServletRequestWrapper {
private HttpServletRequest request;
public MyRequestWrapper(HttpServletRequest request) {
super(request);
this.request = request;
}
/**
* 先解密，获取明文；然后将明文转化为字节数组；然后再去读取字节数组中的内容
*/
@Override
public ServletInputStream getInputStream() {
String bizBindMsg = null;
ServletInputStream stream = null;
try {
stream = request.getInputStream();
bizBindMsg = IOUtils.toString(stream, "UTF-8");
} catch (IOException e) {
e.printStackTrace();
}
try {
bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
System.out.println("MyRequestWrapper接收到的请求为: " + bizBindMsg);
/**
* 获取加密的值进行解密
*/
final StringBuffer reqStr = new StringBuffer();
reqStr.append("param1=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param1=") + 7,
bizBindMsg.indexOf("param2="))));
reqStr.append("&");
reqStr.append("param2=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param2=") + 7,
bizBindMsg.indexOf("param3="))));
reqStr.append("&");
reqStr.append("param3=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(
bizBindMsg.indexOf("param3=") + 7,
bizBindMsg.indexOf("param4="))));
reqStr.append("&");
reqStr.append("param4=").append(
Base64EnDecrypt.base64Decode(bizBindMsg.substring(bizBindMsg
.indexOf("param4=") + 7)));
System.out.println("********MyRequestWrapper接收到的解密后的请求为*********");
System.out.println(reqStr.toString());
/**
* 将解密后的明文串放到buffer数组中
*/
byte[] buffer = null;
try {
buffer = reqStr.toString().getBytes("UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);
ServletInputStream newStream = new ServletInputStream() {
@Override
public int read() throws IOException {
return bais.read();
}
};
return newStream;
}
}
最后是简单的Filter，在这里将加密后的ServletRequest重新包装，交给SiServlet进行处理
Java代码
public class EncryptFilter implements Filter {
@Override
public void destroy() {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
chain.doFilter(new MyRequestWrapper((HttpServletRequest) request),
response);
}
@Override
public void init(FilterConfig arg0) throws ServletException {
}
}
我的web.xml中是这样配置的
Java代码
<filter>
<filter-name>encryptFilter</filter-name>
<filter-class>com.test.filter.EncryptFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>encryptFilter</filter-name>
<url-pattern>/SiServlet</url-pattern>
</filter-mapping>
确保过滤器entyptFilter只拦截到SiServlet的请求即可。
运行AdcClient，可以看到下面的结果
这里的重点是MyRequestWrapper中重写的getInputStream()方法。大家可以看看API中关于HttpServletRequest的用法http://tomcat.apache.org/tomcat-5.5-doc/servletapi/index.html。
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- 使用HttpServletRequestWrapper在filter修改request参数
- 使用HttpServletRequestWrapper 实现防止xss攻击和sql注入
- HttpServletRequest.getInputStream可读取多次解决方案之一，使用HttpServletRequestWrapper
- SpringMVC——使用RequestDispatcher.include()和HttpServletResponseWrapper动态获取jsp输出内容
- HttpServletRequestWrapper的使用
- HttpServletRequestWrapper的使用
- HttpServletRequestWrapper,HttpServletResponseWrapper在过滤器Filter中的使用
- HttpServletRequestWrapper 的使用
- HttpServletRequestWrapper使用技巧（自定义session和缓存InputStream）
- HttpServletRequestWrapper的使用
- SpringMVC XSS之HttpServletRequestWrapper使用风险与应对方案
- Filter过滤器及HttpServletRequestWrapper使用
- SpringMVC——使用RequestDispatcher.include()和HttpServletResponseWrapper动态获取jsp输出内容
- HttpServletRequestWrapper 实现xss注入
- servlet中使用HttpServletResponseWrapper截获返回的页面内容
- java中servletContextListener、httpSessionListener和servletRequestListener使用整理
- HttpServletRequestWrapper采用装饰模式重新封装request，并打印request请求相关参数。
- springmvc使用HttpServletRequest
- Spring MVC 使用 HttpServletResponseWrapper 修改返回结果
- servlet中使用HttpServletResponseWrapper截获返回的页面内容