关于tomcat,request.getParameterMap修改map值的问题
网上都是getParameterMap取到的数据不能修改但是我继承HttpServletRequestWrapper的类竟然修改成功了看代码：
package com.uniresource.framework.security;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.springframework.web.util.HtmlUtils;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
super(servletRequest);
}
public String[] getParameterValues(String parameter) {
String[] values = super.getParameterValues(parameter);
if (values==null){
return null;
}
int count = values.length;
String[] encodedValues = new String;
for (int i = 0; i < count; i++) {
encodedValues = cleanXSS(values);
}
return encodedValues;
}
public String getParameter(String parameter) {
String value = super.getParameter(parameter);
if (value == null) {
return null;
}
return cleanXSS(value);
}
@Override
public Map getParameterMap() {
Map map=super.getParameterMap();
Set set=map.keySet();
Iterator iter=set.iterator();
while(iter.hasNext()){
String key=iter.next().toString();
Object obj=map.get(key);
String[] param=(String[])obj;
//String[] newParam=new String;
for(int i=0;i<param.length;i++){
String s=param;
param=HtmlUtils.htmlEscape(s);
//newParam=HtmlUtils.htmlEscape(s);
}
//map.put(key, newParam);
}
/*for(int i=0;i<map.size();i++){
Object obj=map.get(i);
if(obj instanceof String){
System.out.println(obj.toString());
}
}*/
return map;
}
public String getHeader(String name) {
String value = super.getHeader(name);
if (value == null)
return null;
return cleanXSS(value);
}
private String cleanXSS(String value) {
//You'll need to remove the spaces from the html entities below
value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
value = value.replaceAll("'", "& #39;");
value = value.replaceAll("eval\\((.*)\\)", "");
value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
value = value.replaceAll("script", "ｓｃｒｉｐｔ");
value = HtmlUtils.htmlEscape(value);
return value;
}
}
所以就去查看了下org.apache.catalina.util.ParameterMap的源码 原来我的tomcat中这个类的locked是非锁定的。还是说现在的tomcat这个值都是非锁定状态的。
/* */ package org.apache.catalina.util;
/* */
/* */ import java.util.HashMap;
/* */ import java.util.Map;
/* */ import org.apache.tomcat.util.res.StringManager;
/* */
/* */ public final class ParameterMap<K, V> extends HashMap<K, V>
/* */ {
/* */ private static final long serialVersionUID = 1L;
/* 101 */ private boolean locked = false;
/* */
/* 129 */ private static final StringManager sm = StringManager.getManager("org.apache.catalina.util");
/* */
/* */ public ParameterMap()
/* */ {
/* */ }
/* */
/* */ public ParameterMap(int initialCapacity)
/* */ {
/*64 */ super(initialCapacity);
/* */ }
/* */
/* */ public ParameterMap(int initialCapacity, float loadFactor)
/* */ {
/*78 */ super(initialCapacity, loadFactor);
/* */ }
/* */
/* */ public ParameterMap(Map<K, V> map)
/* */ {
/*90 */ super(map);
/* */ }
/* */
/* */ public boolean isLocked()
/* */ {
/* 109 */ return this.locked;
/* */ }
/* */
/* */ public void setLocked(boolean locked)
/* */ {
/* 121 */ this.locked = locked;
/* */ }
/* */
/* */ public void clear()
/* */ {
/* 145 */ if (this.locked) {
/* 146 */ throw new IllegalStateException(sm.getString("parameterMap.locked"));
/* */ }
/* 148 */ super.clear();
/* */ }
/* */
/* */ public V put(K key, V value)
/* */ {
/* 169 */ if (this.locked) {
/* 170 */ throw new IllegalStateException(sm.getString("parameterMap.locked"));
/* */ }
/* 172 */ return super.put(key, value);
/* */ }
/* */
/* */ public void putAll(Map<? extends K, ? extends V> map)
/* */ {
/* 189 */ if (this.locked) {
/* 190 */ throw new IllegalStateException(sm.getString("parameterMap.locked"));
/* */ }
/* 192 */ super.putAll(map);
/* */ }
/* */
/* */ public V remove(Object key)
/* */ {
/* 210 */ if (this.locked) {
/* 211 */ throw new IllegalStateException(sm.getString("parameterMap.locked"));
/* */ }
/* 213 */ return super.remove(key);
/* */ }
/* */ }
/* Location: E:\apache-tomcat-7.0.30\lib\catalina.jar
* Qualified Name: org.apache.catalina.util.ParameterMap
* Java Class Version: 6 (50.0)
* JD-Core Version: 0.5.3
*/
页:
[1]