You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

71 line
2.9 KiB

  1. package com.iformall.interceptor;
  2. import com.iformall.utils.UrlCheck;
  3. import org.slf4j.Logger;
  4. import org.slf4j.LoggerFactory;
  5. import javax.servlet.*;
  6. import javax.servlet.http.HttpServletRequest;
  7. import java.io.IOException;
  8. public class HttpServletRequestWrapperFilter implements Filter {
  9. private static final Logger logger = LoggerFactory.getLogger(HttpServletRequestWrapperFilter.class);
  10. // 多个跨域域名设置
  11. // public static final String[] ALLOW_DOMAIN = {"https://admin.malls.iformall.com"};
  12. @Override
  13. public void init(FilterConfig filterConfig) throws ServletException {
  14. }
  15. @Override
  16. public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
  17. throws IOException, ServletException {
  18. ServletRequest requestWrapper = null;
  19. /* // 跨域访问
  20. HttpServletRequest req = (HttpServletRequest) request;
  21. HttpServletResponse res = (HttpServletResponse) response;
  22. String originHeader = req.getHeader("Origin");
  23. if (Arrays.asList(ALLOW_DOMAIN).contains(originHeader)) {
  24. //通过在响应 header 中设置 ‘*’ 来允许来自所有域的跨域请求访问。
  25. res.setHeader("Access-Control-Allow-Origin", originHeader);
  26. //通过对 Credentials 参数的设置,就可以保持跨域 Ajax 时的 Cookie
  27. //设置了Allow-Credentials,Allow-Origin就不能为*,需要指明具体的url域
  28. res.setHeader("Access-Control-Allow-Credentials", "true");
  29. //请求方式
  30. res.setHeader("Access-Control-Allow-Methods", "*");
  31. //(预检请求)的返回结果(即 Access-Control-Allow-Methods 和Access-Control-Allow-Headers 提供的信息) 可以被缓存多久
  32. res.setHeader("Access-Control-Max-Age", "86400");
  33. //首部字段用于预检请求的响应。其指明了实际请求中允许携带的首部字段
  34. //res.setHeader("Access-Control-Allow-Headers", "*");
  35. res.setHeader("Access-Control-Allow-Headers",
  36. "Timestamp,Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,Access-Control-Allow-Headers");
  37. }
  38. */
  39. //sql,xss过滤
  40. XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper((HttpServletRequest)request);
  41. if (request instanceof HttpServletRequest) {
  42. String url = ((HttpServletRequest) request).getRequestURI();
  43. if (!UrlCheck.checkUrl(url)) {
  44. requestWrapper = new BodyReaderHttpServletRequestWrapper((HttpServletRequest) request);
  45. }
  46. }
  47. if (null == requestWrapper) {
  48. chain.doFilter(xssHttpServletRequestWrapper, response);
  49. } else {
  50. chain.doFilter(requestWrapper, response);
  51. }
  52. }
  53. @Override
  54. public void destroy() {
  55. }
  56. }