手写tomcat系列3-长叶-第一个Servlet容器优化

系列2遗留问题

本文接系列2，首先抛出一个问题，系列2实现的第一个Servlet容器有一个安全问题：在 ServletProcessor1 类的 process 方法中执行servlet 的 service 方 法时，request对象向上转型为 javax.servlet.ServletRequest对象，response向上转型为
javax.servlet.ServletResponse对象。

try {
servlet = (Servlet) myClass.newInstance();
servlet.service((ServletRequest) request,(ServletResponse) response);
}

这种玩法存在安全漏洞，具体问题为：知道这个servlet 容器的内部运作的程序员可以分别把ServletRequest 和 ServletResponse 实例向下转型本容器的Request 和Response对象，并调用Request 和Response对象的公共方法。如可以调用Request的parse方法或调用Response的sendStaticResource 方法。同时不能将 parse 和 sendStaticResource 方法定义为private，因为其他的类需要调用上述两个方法。
解决思路一：让 Request 和Response 类拥有默认访问修饰（包访问权限），不允许在包外部被调用。
解决思路二：更优雅的解决办法，门面模式，使用 facade 类隐藏Request 和Response。
划重点：本次优化是思路二的实现。

RequestFacade类代码实现：

/**
*** 门面模式应用，区别于代理模式，这里应用的目的是隐藏真request对象，而不是代理一个request对象接受用户请求。
* 使用此模式用户保护response和request对象中方法不被劫持利用。**
*/
public class RequestFacade implements ServletRequest {
**// 持有私有化的ServletRequest对象，通过构造函数初始化，通过此方式隐藏真request对象**
private ServletRequest request = null;
public RequestFacade(Request request) {
this.request = request;
}
/* implementation of the ServletRequest*/
public Object getAttribute(String attribute) {
return request.getAttribute(attribute);
}
public Enumeration<?> getAttributeNames() {
return request.getAttributeNames();
}
@SuppressWarnings("deprecation")
public String getRealPath(String path) {
return request.getRealPath(path);
}
public RequestDispatcher getRequestDispatcher(String path) {
return request.getRequestDispatcher(path);
}
public boolean isSecure() {
return request.isSecure();
}
public String getCharacterEncoding() {
return request.getCharacterEncoding();
}
public int getContentLength() {
return request.getContentLength();
}
public String getContentType() {
return request.getContentType();
}
public ServletInputStream getInputStream() throws IOException {
return request.getInputStream();
}
public Locale getLocale() {
return request.getLocale();
}
public Enumeration getLocales() {
return request.getLocales();
}
public String getParameter(String name) {
return request.getParameter(name);
}
public Map getParameterMap() {
return request.getParameterMap();
}
public Enumeration getParameterNames() {
return request.getParameterNames();
}
public String[] getParameterValues(String parameter) {
return request.getParameterValues(parameter);
}
public String getProtocol() {
return request.getProtocol();
}
public BufferedReader getReader() throws IOException {
return request.getReader();
}
public String getRemoteAddr() {
return request.getRemoteAddr();
}
public String getRemoteHost() {
return request.getRemoteHost();
}
public String getScheme() {
return request.getScheme();
}
public String getServerName() {
return request.getServerName();
}
public int getServerPort() {
return request.getServerPort();
}
public void removeAttribute(String attribute) {
request.removeAttribute(attribute);
}
public void setAttribute(String key, Object value) {
request.setAttribute(key, value);
}
public void setCharacterEncoding(String encoding)
throws UnsupportedEncodingException {
request.setCharacterEncoding(encoding);
}
}

ResponseFacade类代码实现：

/**
* 门面模式应用，区别于代理模式，这里应用的目的是隐藏真request对象，而不是代理一个request对象接受用户请求。
* 使用此模式用户保护response和request对象中方法不被劫持利用。
*/
public class ResponseFacade implements ServletResponse {
private ServletResponse response;
public ResponseFacade(Response response) {
this.response = response;
}
public void flushBuffer() throws IOException {
response.flushBuffer();
}
public int getBufferSize() {
return response.getBufferSize();
}
public String getCharacterEncoding() {
return response.getCharacterEncoding();
}
public Locale getLocale() {
return response.getLocale();
}
public ServletOutputStream getOutputStream() throws IOException {
return response.getOutputStream();
}
public PrintWriter getWriter() throws IOException {
return response.getWriter();
}
public boolean isCommitted() {
return response.isCommitted();
}
public void reset() {
response.reset();
}
public void resetBuffer() {
response.resetBuffer();
}
public void setBufferSize(int size) {
response.setBufferSize(size);
}
public void setContentLength(int length) {
response.setContentLength(length);
}
public void setContentType(String type) {
response.setContentType(type);
}
public void setLocale(Locale locale) {
response.setLocale(locale);
}
}

ServletProcessor2.0实现（ServletProcessor1升级版）

public class ServletProcessor2 {
public void process(Request request, Response response) {
String uri = request.getUri();
String servletName = uri.substring(uri.lastIndexOf("/") + 1);
URLClassLoader loader = null;
try {
// create a URLClassLoader
URL[] urls = new URL[1];
URLStreamHandler streamHandler = null;
File classPath = new File(Constants.WEB_ROOT);
// the forming of repository is taken from the createClassLoader method in
// org.apache.catalina.startup.ClassLoaderFactory
String repository = (new URL("file", null, classPath.getCanonicalPath() + File.separator)).toString() ;
// the code for forming the URL is taken from the addRepository method in
// org.apache.catalina.loader.StandardClassLoader class.
urls[0] = new URL(null, repository, streamHandler);
loader = new URLClassLoader(urls);
}
catch (IOException e) {
System.out.println(e.toString() );
}
Class myClass = null;
try {
myClass = loader.loadClass(servletName);
}catch (ClassNotFoundException e) {
System.out.println(e.toString());
}
Servlet servlet = null;
/**
* 门面模式应用，区别于代理模式，这里应用的目的是隐藏真request对象，而不是代理一个request对象接受用户请求。
*/
**RequestFacade requestFacade = new RequestFacade(request);
ResponseFacade responseFacade = new ResponseFacade(response);**
try {
servlet = (Servlet) myClass.newInstance();
**servlet.service((ServletRequest) requestFacade, (ServletResponse) responseFacade);**
}
catch (Exception e) {
System.out.println(e.toString());
}
catch (Throwable e) {
System.out.println(e.toString());
}
}
}

其他类和系列2完全相同，不再重复列出。