关于tomcat,request.getParameterMap修改map值的问题

lijm1522

网上都是getParameterMap取到的数据不能修改  但是我继承HttpServletRequestWrapper的类竟然修改成功了
看代码：

package com.uniresource.framework.security;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.springframework.web.util.HtmlUtils;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
super(servletRequest);
}
public String[] getParameterValues(String parameter) {
String[] values = super.getParameterValues(parameter);
if (values==null)  {
return null;
}
int count = values.length;
String[] encodedValues = new String[count];
for (int i = 0; i < count; i++) {
encodedValues = cleanXSS(values);
}
return encodedValues;
}
public String getParameter(String parameter) {
String value = super.getParameter(parameter);
if (value == null) {
return null;
}
return cleanXSS(value);
}
@Override
public Map getParameterMap() {
Map map=super.getParameterMap();
Set set=map.keySet();
Iterator iter=set.iterator();
while(iter.hasNext()){
String key=iter.next().toString();
Object obj=map.get(key);
String[] param=(String[])obj;
//String[] newParam=new String[param.length];
for(int i=0;i<param.length;i++){
String s=param;
param=HtmlUtils.htmlEscape(s);
//newParam=HtmlUtils.htmlEscape(s);
}
//map.put(key, newParam);
}
/*for(int i=0;i<map.size();i++){
Object obj=map.get(i);
if(obj instanceof String){
System.out.println(obj.toString());
}
}*/
return map;
}
public String getHeader(String name) {
String value = super.getHeader(name);
if (value == null)
return null;
return cleanXSS(value);
}
private String cleanXSS(String value) {
//You'll need to remove the spaces from the html entities below
value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
value = value.replaceAll("'", "& #39;");
value = value.replaceAll("eval\\((.*)\\)", "");
value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
value = value.replaceAll("script", "ｓｃｒｉｐｔ");
value = HtmlUtils.htmlEscape(value);
return value;
}
}

所以就去查看了下org.apache.catalina.util.ParameterMap的源码 原来我的tomcat中这个类的locked是非锁定的。还是说现在的tomcat这个值都是非锁定状态的。
/*     */ package org.apache.catalina.util;
/*     */
/*     */ import java.util.HashMap;
/*     */ import java.util.Map;
/*     */ import org.apache.tomcat.util.res.StringManager;
/*     */
/*     */ public final class ParameterMap<K, V> extends HashMap<K, V>
/*     */ {
/*     */   private static final long serialVersionUID = 1L;
/* 101 */   private boolean locked = false;
/*     */
/* 129 */   private static final StringManager sm = StringManager.getManager("org.apache.catalina.util");
/*     */
/*     */   public ParameterMap()
/*     */   {
/*     */   }
/*     */
/*     */   public ParameterMap(int initialCapacity)
/*     */   {
/*  64 */     super(initialCapacity);
/*     */   }
/*     */
/*     */   public ParameterMap(int initialCapacity, float loadFactor)
/*     */   {
/*  78 */     super(initialCapacity, loadFactor);
/*     */   }
/*     */
/*     */   public ParameterMap(Map<K, V> map)
/*     */   {
/*  90 */     super(map);
/*     */   }
/*     */
/*     */   public boolean isLocked()
/*     */   {
/* 109 */     return this.locked;
/*     */   }
/*     */
/*     */   public void setLocked(boolean locked)
/*     */   {
/* 121 */     this.locked = locked;
/*     */   }
/*     */
/*     */   public void clear()
/*     */   {
/* 145 */     if (this.locked) {
/* 146 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 148 */     super.clear();
/*     */   }
/*     */
/*     */   public V put(K key, V value)
/*     */   {
/* 169 */     if (this.locked) {
/* 170 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 172 */     return super.put(key, value);
/*     */   }
/*     */
/*     */   public void putAll(Map<? extends K, ? extends V> map)
/*     */   {
/* 189 */     if (this.locked) {
/* 190 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 192 */     super.putAll(map);
/*     */   }
/*     */
/*     */   public V remove(Object key)
/*     */   {
/* 210 */     if (this.locked) {
/* 211 */       throw new IllegalStateException(sm.getString("parameterMap.locked"));
/*     */     }
/* 213 */     return super.remove(key);
/*     */   }
/*     */ }
/* Location:           E:\apache-tomcat-7.0.30\lib\catalina.jar
* Qualified Name:     org.apache.catalina.util.ParameterMap
* Java Class Version: 6 (50.0)
* JD-Core Version:    0.5.3
*/