HttpServletResponseWrapper的getParamertervalues（）没有得到调用

我正在编写一个请求封装类来修复跨站点脚本问题。我面临的问题是当我调用chain.dofilter（wrapperclass）时，getParameterValues（）方法没有得到调用。任何人都可以帮助我为什么你的方法没有被触发？HttpServletResponseWrapper的getParamertervalues（）没有得到调用

import java.util.regex.Pattern; 
    import javax.servlet.http.HttpServletRequest; 
    import javax.servlet.http.HttpServletRequestWrapper; 

    public class XSSRequestWrapper extends HttpServletRequestWrapper { 

     private static Pattern[] patterns = new Pattern[]{ 
      // Script fragments 
      Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE), 
      // src='...' 
      Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), 
      Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), 
      // lonely script tags 
      Pattern.compile("</script>", Pattern.CASE_INSENSITIVE), 
      Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), 
      // eval(...) 
      Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), 
      // expression(...) 
      Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), 
      // javascript:... 
      Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE), 
      // vbscript:... 
      Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE), 
      // onload(...)=... 
      Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL) 
     }; 

     public XSSRequestWrapper(HttpServletRequest servletRequest) { 
      super(servletRequest); 
     } 

     @Override 
     public String[] getParameterValues(String parameter) { 
      String[] values = super.getParameterValues(parameter); 

      if (values == null) { 
       return null; 
      } 

      int count = values.length; 
      String[] encodedValues = new String[count]; 
      for (int i = 0; i < count; i++) { 
       encodedValues[i] = stripXSS(values[i]); 
      } 

      return encodedValues; 
     } 

     @Override 
     public String getParameter(String parameter) { 
      String value = super.getParameter(parameter); 

      return stripXSS(value); 
     } 

     @Override 
     public String getHeader(String name) { 
      String value = super.getHeader(name); 
      return stripXSS(value); 
     } 

     private String stripXSS(String value) { 
      if (value != null) { 
       // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to 
       // avoid encoded attacks. 
       // value = ESAPI.encoder().canonicalize(value); 

       // Avoid null characters 
       value = value.replaceAll("\0", ""); 

       // Remove all sections that match a pattern 
       for (Pattern scriptPattern : patterns){ 
        value = scriptPattern.matcher(value).replaceAll(""); 
       } 
      } 
      return value; 
     } 
    } 



import java.io.IOException; 

import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.HttpServletRequest; 

public final class XSSFilter implements Filter { 

    @Override 
    public void init(FilterConfig arg0) throws ServletException { 
    } 

    @Override 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 
     XSSRequestWrapper requestWrapper = new XSSRequestWrapper((HttpServletRequest) request); 
     chain.doFilter(requestWrapper, response); 
    } 

    @Override 
    public void destroy() { 
    } 
}

来源

2017-07-19 user2160534

Servlet API提供了多种方法来从ServletRequest中提取参数。一个特定的Servlet实现可以使用这些方法中的任何一种来提取参数。如果您没有看到任何ServletRequest#getParameterValues(String)的调用，那么您过滤到的底层servlet可能不会调用该方法。也许它正在调用其他方法。

完成的缘故，我建议你的请求包装覆盖所有的这些方法：

来源

2017-07-19 22:38:16

没有以上上述方法没有被调用 – user2160534

HttpServletResponseWrapper的getParamertervalues（）没有得到调用

回答

相关问题