ajax请求和Filter配合案例

2016-12-04 10:03:02来源:CSDN作者:StromMaybin人点击

@ author StormMaybin
@ date 2016-12-03


生命不息,奋斗不止!

案例引入

现在有这样一个问题,就是在提交大片文字评论的时候,前台拿到数据之后给后台发送ajax请求,然后后台有一个防止SQL注入的Filter,这个Filter得到这个前台传过来的数据之后,进行合法性校验,如果没有校验成功,那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。

思路一:请求转发实现

ajax请求
$.ajax({            method:'post',            url:'servlet/DemoServlet',            dataType:'json',            data:{                'userName':userName,                'passWord':passWord,                'text': text            },            success:function(data){                //成功之后的逻辑            },            error:function(){                //错误之后的逻辑            }        });
防止SQL注入Filter
package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{    public void doFilter(ServletRequest request, ServletResponse response,            FilterChain chain) throws IOException, ServletException    {        HttpServletRequest req = (HttpServletRequest) request;        HttpServletResponse res = (HttpServletResponse) response;        // 获得所有请求参数名        Enumeration params = req.getParameterNames();        String sql = "";        while (params.hasMoreElements())        {            // 得到参数名            String name = params.nextElement().toString();            // System.out.println("name===========================" + name +            // "--");            // 得到参数对应值            String[] value = req.getParameterValues(name);            for (int i = 0; i < value.length; i++)            {                sql = sql + value[i];            }           }        System.out.println("提交方式:"+req.getMethod());        System.out.println("被匹配字符串:" + sql);        if (sqlValidate(sql))        {            //请求转发            req.getRequestDispatcher("error.jsp").            forward(req, res);                  }        else        {            String   request_uri   =   req.getRequestURI();              chain.doFilter(request, response);        }    }    // 校验    protected static boolean sqlValidate(String str)    {        str = str.toLowerCase();// 统一转为小写        // String badStr = "and|exec";        String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";        /*         * String badStr =         * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"         * +         * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"         * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";         */// 过滤掉的sql关键字,可以手动添加        String[] badStrs = badStr.split("//|");        for (int i = 0; i < badStrs.length; i++)        {            if (str.indexOf(badStrs[i]) != -1)            {                System.out.println("匹配到:" + badStrs[i]);                return true;            }        }        return false;    }    public void init(FilterConfig filterConfig) throws ServletException    {        // throw new UnsupportedOperationException("Not supported yet.");    }    public void destroy()    {        // throw new UnsupportedOperationException("Not supported yet.");    }}

web.xml配置

 <filter>    <display-name>SQLFilter</display-name>    <filter-name>SQLFilter</filter-name>    <filter-class>com.yiyexiaoyuan.filter.SQLFilter</filter-class>  </filter>  <filter-mapping>    <filter-name>SQLFilter</filter-name>    <url-pattern>/servlet/*</url-pattern>  </filter-mapping>  <filter>

分析,ajax请求DemoServlet,然后请求先被防止SQL注入这个Filter过滤器先过滤,然后过滤到的请求参数构成一个匹配字符串,然后检查是否是恶意代码,如果是的话,请求转发。但是很遗憾,逻辑上这个是对的,但是ajax请求是局部刷新的,最后是要回到ajax请求发起的这个页面的,所以请求转发不会实现,我们看下一种实现逻辑。

思路二:返回值进行判断

这个思路的逻辑是这样的:在Filter过滤掉信息的时候,给ajax请求回送一个json数据,然后返回给前台,前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。

ajax请求

$.ajax({            method:'post',            url:'servlet/DemoServlet',            dataType:'json',            data:{                'userName':userName,                'passWord':passWord,                'text': text            },            success:function(data){                //成功之后的逻辑                if (data.mssage!=""){                    //执行处理恶意代码的逻辑                }                else{                }            },            error:function(){                //错误之后的逻辑            }        });

防止SQL注入的Filter

package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{    public void doFilter(ServletRequest request, ServletResponse response,            FilterChain chain) throws IOException, ServletException    {        HttpServletRequest req = (HttpServletRequest) request;        HttpServletResponse res = (HttpServletResponse) response;        // 获得所有请求参数名        Enumeration params = req.getParameterNames();        String sql = "";        while (params.hasMoreElements())        {            // 得到参数名            String name = params.nextElement().toString();            // System.out.println("name===========================" + name +            // "--");            // 得到参数对应值            String[] value = req.getParameterValues(name);            for (int i = 0; i < value.length; i++)            {                sql = sql + value[i];            }           }        System.out.println("提交方式:"+req.getMethod());        System.out.println("被匹配字符串:" + sql);        if (sqlValidate(sql))        {        //传送json数据            JSONObject json = new JSONObject();            json.accumulate("message", "恶意代码注入");            res.getWriter().print(json.toString());             }        else        {            String   request_uri   =   req.getRequestURI();              chain.doFilter(request, response);        }    }    // 校验    protected static boolean sqlValidate(String str)    {        str = str.toLowerCase();// 统一转为小写        // String badStr = "and|exec";        String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";        /*         * String badStr =         * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"         * +         * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"         * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";         */// 过滤掉的sql关键字,可以手动添加        String[] badStrs = badStr.split("//|");        for (int i = 0; i < badStrs.length; i++)        {            if (str.indexOf(badStrs[i]) != -1)            {                System.out.println("匹配到:" + badStrs[i]);                return true;            }        }        return false;    }    public void init(FilterConfig filterConfig) throws ServletException    {        // throw new UnsupportedOperationException("Not supported yet.");    }    public void destroy()    {        // throw new UnsupportedOperationException("Not supported yet.");    }}

思路三:异常+跳转实现

这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话,抛出RuntimeException(),然后导致ajax请求失败,然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢?经过我认真思考之后,我们可以这样做,在session存一个error_messgae值,然后ajax请求的error方法跳转到错误页面,然后进行取值渲染错误页面。

ajax请求

$.ajax({            method:'post',            url:'servlet/DemoServlet',            dataType:'json',            data:{                'userName':userName,                'passWord':passWord,                'text': text            },            success:function(data){                //成功之后的逻辑            },            error:function(){                window.location.href="error.jsp";            }        });

防止SQL注入Filter

package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{    public void doFilter(ServletRequest request, ServletResponse response,            FilterChain chain) throws IOException, ServletException    {        HttpServletRequest req = (HttpServletRequest) request;        HttpServletResponse res = (HttpServletResponse) response;        // 获得所有请求参数名        Enumeration params = req.getParameterNames();        String sql = "";        while (params.hasMoreElements())        {            // 得到参数名            String name = params.nextElement().toString();            // System.out.println("name===========================" + name +            // "--");            // 得到参数对应值            String[] value = req.getParameterValues(name);            for (int i = 0; i < value.length; i++)            {                sql = sql + value[i];            }           }        System.out.println("提交方式:"+req.getMethod());        System.out.println("被匹配字符串:" + sql);        if (sqlValidate(sql))        {            req.getSession().setAttribute("error_message","恶意注入了");             throw new  RuntimeException("恶意注入");        }        else        {            String   request_uri   =   req.getRequestURI();              chain.doFilter(request, response);        }    }    // 校验    protected static boolean sqlValidate(String str)    {        str = str.toLowerCase();// 统一转为小写        // String badStr = "and|exec";        String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";        /*         * String badStr =         * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"         * +         * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"         * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";         */// 过滤掉的sql关键字,可以手动添加        String[] badStrs = badStr.split("//|");        for (int i = 0; i < badStrs.length; i++)        {            if (str.indexOf(badStrs[i]) != -1)            {                System.out.println("匹配到:" + badStrs[i]);                return true;            }        }        return false;    }    public void init(FilterConfig filterConfig) throws ServletException    {        // throw new UnsupportedOperationException("Not supported yet.");    }    public void destroy()    {        // throw new UnsupportedOperationException("Not supported yet.");    }}

error.jsp实现

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %><%String path = request.getContextPath();String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";%><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html>  <head>    <base href="<%=basePath%>">    <title>错误页面</title>    <meta http-equiv="pragma" content="no-cache">    <meta http-equiv="cache-control" content="no-cache">    <meta http-equiv="expires" content="0">        <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">    <meta http-equiv="description" content="This is my page">    <!--    <link rel="stylesheet" type="text/css" href="styles.css">    -->  </head>  <body>    <center>            系统出错了,请稍后再试......        <br />        <br />        <br />        <br />        错误信息是: ${ error_message}    </center>      </body></html>

这样就很巧妙得实现了Filter拦截并友好提示。

最新文章

123

最新摄影

微信扫一扫

第七城市微信公众平台