chenrui
2 years ago
27 changed files with 727 additions and 6110 deletions
@ -0,0 +1,49 @@ |
|||
package com.zdxt.auth.framework.config; |
|||
|
|||
import org.springframework.http.HttpHeaders; |
|||
import org.springframework.http.ResponseCookie; |
|||
import org.springframework.stereotype.Component; |
|||
|
|||
import javax.servlet.*; |
|||
import javax.servlet.http.Cookie; |
|||
import javax.servlet.http.HttpServletRequest; |
|||
import javax.servlet.http.HttpServletResponse; |
|||
import java.io.IOException; |
|||
|
|||
//@Component
|
|||
public class CookieFilter implements Filter { |
|||
|
|||
|
|||
@Override |
|||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { |
|||
HttpServletRequest httpRequest = (HttpServletRequest) servletRequest; |
|||
HttpServletResponse httpResponse = (HttpServletResponse) servletResponse; |
|||
|
|||
//这里模拟下浏览器发送请求中包含三个cookie,
|
|||
// 因为后端在request中无法添加cookie,咱们就先添加到response中，
|
|||
//第一次请求把三个cookie带到客户端，再请求时浏览器就把这三个cookie带过来了
|
|||
// Cookie cookie1 = new Cookie("name","lsl");
|
|||
// httpResponse.addCookie(cookie1);
|
|||
// Cookie cookie2 = new Cookie("age","18");
|
|||
// httpResponse.addCookie(cookie2);
|
|||
// Cookie cookie3 = new Cookie("addr","beijing");
|
|||
// httpResponse.addCookie(cookie3);
|
|||
|
|||
String url = httpRequest.getRequestURL().toString(); |
|||
|
|||
Cookie[] cookies = httpRequest.getCookies(); |
|||
if (cookies != null){ |
|||
StringBuilder sb = new StringBuilder(); |
|||
for (Cookie cookie : cookies){ |
|||
String cookieName = cookie.getName(); |
|||
String cookieValue = cookie.getValue(); |
|||
System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue); |
|||
ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build(); |
|||
httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString()); |
|||
|
|||
} |
|||
} |
|||
|
|||
filterChain.doFilter(httpRequest,httpResponse); |
|||
} |
|||
} |
|||
@ -0,0 +1,83 @@ |
|||
package com.zdxt.auth.framework.config; |
|||
|
|||
import org.springframework.beans.factory.annotation.Value; |
|||
|
|||
import org.springframework.stereotype.Component; |
|||
|
|||
import javax.servlet.*; |
|||
|
|||
import javax.servlet.http.HttpServletRequest; |
|||
import javax.servlet.http.HttpServletResponse; |
|||
import java.io.IOException; |
|||
import java.util.Arrays; |
|||
import java.util.List; |
|||
|
|||
|
|||
/** |
|||
* http host头攻击漏洞处理过滤器， |
|||
* 需要在配置文件添加allowed.servernames可访问host白名单， |
|||
* 多个host用逗号隔开，本地开发使用127.0.0.1,localhost |
|||
* @author liufr |
|||
*/ |
|||
@Component |
|||
public class HostFilter implements Filter{ |
|||
/** |
|||
* 自定义实现host白名单添加 |
|||
*/ |
|||
@Value("${allowed.servernames}") |
|||
private String ALLOWED_SERVERNAMES; |
|||
|
|||
/** |
|||
* host拦截 |
|||
*/ |
|||
@Override |
|||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, |
|||
FilterChain filterChain) throws IOException, ServletException { |
|||
HttpServletRequest request = (HttpServletRequest) servletRequest; |
|||
HttpServletResponse response = (HttpServletResponse) servletResponse; |
|||
// String host = request.getHeader("host");
|
|||
String serverName = request.getServerName(); |
|||
System.out.println("serverName-debug:" + serverName); |
|||
if (!isEmpty(serverName)) { |
|||
if (checkBlankList(serverName)) { |
|||
filterChain.doFilter(servletRequest, servletResponse); |
|||
} else { |
|||
System.out.println("[serverName deny access tips]->" + serverName); |
|||
// response.getWriter().print("host deny");
|
|||
response.setStatus(403); |
|||
response.flushBuffer(); |
|||
} |
|||
} else { |
|||
filterChain.doFilter(servletRequest, servletResponse); |
|||
} |
|||
|
|||
} |
|||
|
|||
@Override |
|||
public void destroy() { |
|||
// System.out.println("Filter销毁");
|
|||
} |
|||
|
|||
/** |
|||
* 校验当前host是否在白名单中 |
|||
*/ |
|||
private boolean checkBlankList(String serverName) { |
|||
String[] allowdServerName = ALLOWED_SERVERNAMES.split(","); |
|||
List<String> serverNameList = Arrays.asList(allowdServerName); |
|||
for(String str : serverNameList){ |
|||
if(!isEmpty(str) && str.equals(serverName)){ |
|||
return true; |
|||
} |
|||
} |
|||
return false; |
|||
} |
|||
|
|||
/** |
|||
* 判空 |
|||
*/ |
|||
public boolean isEmpty(Object str) { |
|||
return str == null || "".equals(str); |
|||
} |
|||
|
|||
|
|||
} |
|||
@ -0,0 +1,58 @@ |
|||
package com.zdxt.auth.framework.config; |
|||
|
|||
import org.apache.catalina.Context; |
|||
import org.apache.tomcat.util.descriptor.web.SecurityCollection; |
|||
import org.apache.tomcat.util.descriptor.web.SecurityConstraint; |
|||
import org.apache.tomcat.util.http.Rfc6265CookieProcessor; |
|||
import org.apache.tomcat.util.http.SameSiteCookies; |
|||
import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; |
|||
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; |
|||
import org.springframework.boot.web.servlet.server.ServletWebServerFactory; |
|||
import org.springframework.context.annotation.Bean; |
|||
import org.springframework.context.annotation.Configuration; |
|||
|
|||
@Configuration |
|||
public class TomcatConfig { |
|||
|
|||
@Bean |
|||
public ServletWebServerFactory servletContainer() { |
|||
|
|||
TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); |
|||
|
|||
tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ |
|||
|
|||
@Override |
|||
public void customize(Context context) { |
|||
SecurityConstraint constraint = new SecurityConstraint(); |
|||
SecurityCollection collection = new SecurityCollection(); |
|||
//http方法
|
|||
collection.addMethod("PUT"); |
|||
collection.addMethod("DELETE"); |
|||
collection.addMethod("HEAD"); |
|||
collection.addMethod("OPTIONS"); |
|||
collection.addMethod("TRACE"); |
|||
//url匹配表达式 所有路径
|
|||
collection.addPattern("/*"); |
|||
constraint.addCollection(collection); |
|||
//设置以上HTTP方法在指定路径下需要身份验证约束
|
|||
constraint.setAuthConstraint(true); |
|||
context.addConstraint(constraint); |
|||
|
|||
//设置使用httpOnly
|
|||
context.setUseHttpOnly(true); |
|||
} |
|||
}); |
|||
return tomcatServletContainerFactory; |
|||
} |
|||
//tomcat配置
|
|||
@Bean |
|||
public TomcatContextCustomizer sameSiteCookiesConfig() { |
|||
return context -> { |
|||
final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); |
|||
// 设置Cookie的SameSite
|
|||
cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue()); |
|||
context.setCookieProcessor(cookieProcessor); |
|||
}; |
|||
} |
|||
} |
|||
|
|||
@ -0,0 +1,79 @@ |
|||
package com.zdxt.auth.framework.config; |
|||
import java.io.BufferedReader; |
|||
import java.io.IOException; |
|||
import java.io.PrintWriter; |
|||
|
|||
import javax.servlet.Filter; |
|||
import javax.servlet.FilterChain; |
|||
import javax.servlet.FilterConfig; |
|||
import javax.servlet.ServletException; |
|||
import javax.servlet.ServletRequest; |
|||
import javax.servlet.ServletResponse; |
|||
import javax.servlet.http.HttpServletRequest; |
|||
|
|||
import com.alibaba.fastjson.JSONObject; |
|||
import org.apache.commons.lang3.StringUtils; |
|||
|
|||
public class XssAndSqlFilter implements Filter { |
|||
|
|||
@Override |
|||
public void destroy() { |
|||
// TODO Auto-generated method stub
|
|||
|
|||
} |
|||
|
|||
@Override |
|||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) |
|||
throws IOException, ServletException { |
|||
String method = "GET"; |
|||
String param = ""; |
|||
XssAndSqlHttpServletRequestWrapper xssRequest = null; |
|||
if (request instanceof HttpServletRequest) { |
|||
method = ((HttpServletRequest) request).getMethod(); |
|||
xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request); |
|||
} |
|||
if ("POST".equalsIgnoreCase(method)) { |
|||
param = this.getBodyString(xssRequest.getReader()); |
|||
if(StringUtils.isNotBlank(param)){ |
|||
if(xssRequest.checkXSSAndSql(param)){ |
|||
response.setCharacterEncoding("UTF-8"); |
|||
response.setContentType("application/json;charset=UTF-8"); |
|||
PrintWriter out = response.getWriter(); |
|||
out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")); |
|||
return; |
|||
} |
|||
} |
|||
} |
|||
if (xssRequest.checkParameter()) { |
|||
response.setCharacterEncoding("UTF-8"); |
|||
response.setContentType("application/json;charset=UTF-8"); |
|||
PrintWriter out = response.getWriter(); |
|||
out.write(JSONObject.toJSONString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")); |
|||
return; |
|||
} |
|||
chain.doFilter(xssRequest, response); |
|||
} |
|||
|
|||
@Override |
|||
public void init(FilterConfig arg0) throws ServletException { |
|||
// TODO Auto-generated method stub
|
|||
|
|||
} |
|||
|
|||
// 获取request请求body中参数
|
|||
public static String getBodyString(BufferedReader br) { |
|||
String inputLine; |
|||
String str = ""; |
|||
try { |
|||
while ((inputLine = br.readLine()) != null) { |
|||
str += inputLine; |
|||
} |
|||
br.close(); |
|||
} catch (IOException e) { |
|||
System.out.println("IOException: " + e); |
|||
} |
|||
return str; |
|||
|
|||
} |
|||
} |
|||
|
|||
@ -0,0 +1,349 @@ |
|||
package com.zdxt.auth.framework.config; |
|||
|
|||
import java.io.BufferedReader; |
|||
import java.io.ByteArrayInputStream; |
|||
import java.io.IOException; |
|||
import java.io.InputStreamReader; |
|||
import java.util.Enumeration; |
|||
import java.util.HashMap; |
|||
import java.util.Map; |
|||
import java.util.Set; |
|||
import java.util.Vector; |
|||
import java.util.regex.Pattern; |
|||
|
|||
import javax.servlet.ReadListener; |
|||
import javax.servlet.ServletInputStream; |
|||
import javax.servlet.http.HttpServletRequest; |
|||
import javax.servlet.http.HttpServletRequestWrapper; |
|||
|
|||
import org.springframework.util.StreamUtils; |
|||
|
|||
|
|||
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper { |
|||
|
|||
HttpServletRequest orgRequest = null; |
|||
private Map<String, String[]> parameterMap; |
|||
private final byte[] body; //用于保存读取body中数据
|
|||
|
|||
public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{ |
|||
super(request); |
|||
orgRequest = request; |
|||
parameterMap = request.getParameterMap(); |
|||
body = StreamUtils.copyToByteArray(request.getInputStream()); |
|||
} |
|||
|
|||
// 重写几个HttpServletRequestWrapper中的方法
|
|||
/** |
|||
* 获取所有参数名 |
|||
* |
|||
* @return 返回所有参数名 |
|||
*/ |
|||
@Override |
|||
public Enumeration<String> getParameterNames() { |
|||
Vector<String> vector = new Vector<String>(parameterMap.keySet()); |
|||
return vector.elements(); |
|||
} |
|||
|
|||
/** |
|||
* 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/> |
|||
* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/> |
|||
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖 |
|||
*/ |
|||
@Override |
|||
public String getParameter(String name) { |
|||
String[] results = parameterMap.get(name); |
|||
if (results == null || results.length <= 0) |
|||
return null; |
|||
else { |
|||
String value = results[0]; |
|||
if (value != null) { |
|||
value = xssEncode(value); |
|||
} |
|||
return value; |
|||
} |
|||
} |
|||
|
|||
/** |
|||
* 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型 |
|||
*/ |
|||
@Override |
|||
public String[] getParameterValues(String name) { |
|||
String[] results = parameterMap.get(name); |
|||
if (results == null || results.length <= 0) |
|||
return null; |
|||
else { |
|||
int length = results.length; |
|||
for (int i = 0; i < length; i++) { |
|||
results[i] = xssEncode(results[i]); |
|||
} |
|||
return results; |
|||
} |
|||
} |
|||
|
|||
/** |
|||
* 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/> |
|||
* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/> |
|||
* getHeaderNames 也可能需要覆盖 |
|||
*/ |
|||
@Override |
|||
public String getHeader(String name) { |
|||
|
|||
String value = super.getHeader(xssEncode(name)); |
|||
if (value != null) { |
|||
value = xssEncode(value); |
|||
} |
|||
return value; |
|||
} |
|||
|
|||
/** |
|||
* 将容易引起xss & sql漏洞的半角字符直接替换成全角字符 |
|||
* |
|||
* @param s |
|||
* @return |
|||
*/ |
|||
private static String xssEncode(String s) { |
|||
if (s == null || s.isEmpty()) { |
|||
return s; |
|||
} else { |
|||
s = stripXSSAndSql(s); |
|||
} |
|||
StringBuilder sb = new StringBuilder(s.length() + 16); |
|||
for (int i = 0; i < s.length(); i++) { |
|||
char c = s.charAt(i); |
|||
switch (c) { |
|||
case '>': |
|||
sb.append("＞");// 转义大于号
|
|||
break; |
|||
case '<': |
|||
sb.append("＜");// 转义小于号
|
|||
break; |
|||
// case '\'':
|
|||
// sb.append("＇");// 转义单引号
|
|||
// break;
|
|||
// case '\"':
|
|||
// sb.append("＂");// 转义双引号
|
|||
// break;
|
|||
case '&': |
|||
sb.append("＆");// 转义&
|
|||
break; |
|||
case '#': |
|||
sb.append("＃");// 转义#
|
|||
break; |
|||
default: |
|||
sb.append(c); |
|||
break; |
|||
} |
|||
} |
|||
return sb.toString(); |
|||
} |
|||
|
|||
/** |
|||
* 获取最原始的request |
|||
* |
|||
* @return |
|||
*/ |
|||
public HttpServletRequest getOrgRequest() { |
|||
return orgRequest; |
|||
} |
|||
|
|||
/** |
|||
* 获取最原始的request的静态方法 |
|||
* |
|||
* @return |
|||
*/ |
|||
public static HttpServletRequest getOrgRequest(HttpServletRequest req) { |
|||
if (req instanceof XssAndSqlHttpServletRequestWrapper) { |
|||
return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest(); |
|||
} |
|||
return req; |
|||
} |
|||
|
|||
/** |
|||
* |
|||
* 防止xss跨脚本攻击（替换，根据实际情况调整） |
|||
*/ |
|||
|
|||
public static String stripXSSAndSql(String value) { |
|||
if (value != null) { |
|||
// NOTE: It's highly recommended to use the ESAPI library and
|
|||
// uncomment the following line to
|
|||
// avoid encoded attacks.
|
|||
// value = ESAPI.encoder().canonicalize(value);
|
|||
// Avoid null characters
|
|||
/** value = value.replaceAll("", ""); ***/ |
|||
// Avoid anything between script tags
|
|||
Pattern scriptPattern = Pattern.compile( |
|||
"<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid anything in a
|
|||
// src="http://www.yihaomen.com/article/java/..." type of
|
|||
// e-xpression
|
|||
scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Remove any lonesome </script> tag
|
|||
scriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Remove any lonesome <script ...> tag
|
|||
scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid eval(...) expressions
|
|||
scriptPattern = Pattern.compile("eval\\((.*?)\\)", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid e-xpression(...) expressions
|
|||
scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid javascript:... expressions
|
|||
scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid vbscript:... expressions
|
|||
scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
// Avoid οnlοad= expressions
|
|||
scriptPattern = Pattern.compile("onload(.*?)=", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
value = scriptPattern.matcher(value).replaceAll(""); |
|||
} |
|||
return value; |
|||
} |
|||
|
|||
public static boolean checkXSSAndSql(String value) { |
|||
boolean flag = false; |
|||
if (value != null) { |
|||
// NOTE: It's highly recommended to use the ESAPI library and
|
|||
// uncomment the following line to
|
|||
// avoid encoded attacks.
|
|||
// value = ESAPI.encoder().canonicalize(value);
|
|||
// Avoid null characters
|
|||
/** value = value.replaceAll("", ""); ***/ |
|||
// Avoid anything between script tags
|
|||
Pattern scriptPattern = Pattern.compile( |
|||
"<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid anything in a
|
|||
// src="http://www.yihaomen.com/article/java/..." type of
|
|||
// e-xpression
|
|||
scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Remove any lonesome </script> tag
|
|||
scriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Remove any lonesome <script ...> tag
|
|||
scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid eval(...) expressions
|
|||
scriptPattern = Pattern.compile("eval\\((.*?)\\)", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid e-xpression(...) expressions
|
|||
scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid javascript:... expressions
|
|||
scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid vbscript:... expressions
|
|||
scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
// Avoid οnlοad= expressions
|
|||
scriptPattern = Pattern.compile("onload(.*?)=", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
scriptPattern = Pattern.compile("\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*|;|\\+|'|%)", |
|||
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
|||
flag = scriptPattern.matcher(value).find(); |
|||
if (flag) { |
|||
return flag; |
|||
} |
|||
} |
|||
return flag; |
|||
} |
|||
|
|||
public final boolean checkParameter() { |
|||
Map<String, String[]> submitParams = new HashMap(parameterMap); |
|||
Set<String> submitNames = submitParams.keySet(); |
|||
for (String submitName : submitNames) { |
|||
Object submitValues = submitParams.get(submitName); |
|||
if ((submitValues instanceof String)) { |
|||
if (checkXSSAndSql((String) submitValues)) { |
|||
return true; |
|||
} |
|||
} else if ((submitValues instanceof String[])) { |
|||
for (String submitValue : (String[])submitValues){ |
|||
if (checkXSSAndSql(submitValue)) { |
|||
return true; |
|||
} |
|||
} |
|||
} |
|||
} |
|||
return false; |
|||
} |
|||
|
|||
@Override |
|||
public BufferedReader getReader() throws IOException { |
|||
return new BufferedReader(new InputStreamReader(getInputStream())); |
|||
} |
|||
|
|||
@Override |
|||
public ServletInputStream getInputStream() throws IOException { |
|||
final ByteArrayInputStream bais = new ByteArrayInputStream(body); |
|||
return new ServletInputStream() { |
|||
|
|||
@Override |
|||
public int read() throws IOException { |
|||
return bais.read(); |
|||
} |
|||
|
|||
@Override |
|||
public boolean isFinished() { |
|||
// TODO Auto-generated method stub
|
|||
return false; |
|||
} |
|||
|
|||
@Override |
|||
public boolean isReady() { |
|||
// TODO Auto-generated method stub
|
|||
return false; |
|||
} |
|||
|
|||
@Override |
|||
public void setReadListener(ReadListener arg0) { |
|||
// TODO Auto-generated method stub
|
|||
|
|||
} |
|||
}; |
|||
} |
|||
|
|||
} |
|||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
Loading…
Reference in new issue