Ajax请求和Filter配合案例解析
案例引入
现在有这样一个问题,就是在提交大片文字评论的时候,前台拿到数据之后给后台发送ajax请求,然后后台有一个防止SQL注入的Filter,这个Filter得到这个前台传过来的数据之后,进行合法性校验,如果没有校验成功,那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。
思路一:请求转发实现
ajax请求
$.ajax({ method:'post', url:'servlet/DemoServlet', dataType:'json', data:{ 'userName':userName, 'passWord':passWord, 'text':text }, success:function(data){ //成功之后的逻辑 }, error:function(){ //错误之后的逻辑 } });
防止SQL注入Filter
packagecom.yiyexiaoyuan.filter; importjava.io.IOException; importjava.util.Enumeration; importjavax.security.auth.message.callback.PrivateKeyCallback.Request; importjavax.servlet.Filter; importjavax.servlet.FilterChain; importjavax.servlet.FilterConfig; importjavax.servlet.ServletException; importjavax.servlet.ServletRequest; importjavax.servlet.ServletResponse; importjavax.servlet.http.HttpServletRequest; importjavax.servlet.http.HttpServletResponse; importnet.sf.json.JSONObject; //过滤sql关键字的Filter publicclassSQLFilterimplementsFilter { publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse, FilterChainchain)throwsIOException,ServletException { HttpServletRequestreq=(HttpServletRequest)request; HttpServletResponseres=(HttpServletResponse)response; //获得所有请求参数名 Enumerationparams=req.getParameterNames(); Stringsql=""; while(params.hasMoreElements()) { //得到参数名 Stringname=params.nextElement().toString(); //System.out.println("name==========================="+name+ //"--"); //得到参数对应值 String[]value=req.getParameterValues(name); for(inti=0;i<value.length;i++) { sql=sql+value[i]; } } System.out.println("提交方式:"+req.getMethod()); System.out.println("被匹配字符串:"+sql); if(sqlValidate(sql)) { //请求转发 req.getRequestDispatcher("error.jsp"). forward(req,res); } else { Stringrequest_uri=req.getRequestURI(); chain.doFilter(request,response); } } //校验 protectedstaticbooleansqlValidate(Stringstr) { str=str.toLowerCase();//统一转为小写 //StringbadStr="and|exec"; StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/"; /* *StringbadStr= *"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|" *+ *"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|" *+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#"; *///过滤掉的sql关键字,可以手动添加 String[]badStrs=badStr.split("\\|"); for(inti=0;i<badStrs.length;i++) { if(str.indexOf(badStrs[i])!=-1) { System.out.println("匹配到:"+badStrs[i]); returntrue; } } returnfalse; } publicvoidinit(FilterConfigfilterConfig)throwsServletException { //thrownewUnsupportedOperationException("Notsupportedyet."); } publicvoiddestroy() { //thrownewUnsupportedOperationException("Notsupportedyet."); } }
web.xml配置
<filter> <display-name>SQLFilter</display-name> <filter-name>SQLFilter</filter-name> <filter-class>com.yiyexiaoyuan.filter.SQLFilter</filter-class> </filter> <filter-mapping> <filter-name>SQLFilter</filter-name> <url-pattern>/servlet/*</url-pattern> </filter-mapping> <filter>
分析,ajax请求DemoServlet,然后请求先被防止SQL注入这个Filter过滤器先过滤,然后过滤到的请求参数构成一个匹配字符串,然后检查是否是恶意代码,如果是的话,请求转发。但是很遗憾,逻辑上这个是对的,但是ajax请求是局部刷新的,最后是要回到ajax请求发起的这个页面的,所以请求转发不会实现,我们看下一种实现逻辑。
思路二:返回值进行判断
这个思路的逻辑是这样的:在Filter过滤掉信息的时候,给ajax请求回送一个json数据,然后返回给前台,前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。
ajax请求
$.ajax({ method:'post', url:'servlet/DemoServlet', dataType:'json', data:{ 'userName':userName, 'passWord':passWord, 'text':text }, success:function(data){ //成功之后的逻辑 if(data.mssage!=""){ //执行处理恶意代码的逻辑 } else{ } }, error:function(){ //错误之后的逻辑 } });
防止SQL注入的Filter
packagecom.yiyexiaoyuan.filter; importjava.io.IOException; importjava.util.Enumeration; importjavax.security.auth.message.callback.PrivateKeyCallback.Request; importjavax.servlet.Filter; importjavax.servlet.FilterChain; importjavax.servlet.FilterConfig; importjavax.servlet.ServletException; importjavax.servlet.ServletRequest; importjavax.servlet.ServletResponse; importjavax.servlet.http.HttpServletRequest; importjavax.servlet.http.HttpServletResponse; importnet.sf.json.JSONObject; //过滤sql关键字的Filter publicclassSQLFilterimplementsFilter { publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse, FilterChainchain)throwsIOException,ServletException { HttpServletRequestreq=(HttpServletRequest)request; HttpServletResponseres=(HttpServletResponse)response; //获得所有请求参数名 Enumerationparams=req.getParameterNames(); Stringsql=""; while(params.hasMoreElements()) { //得到参数名 Stringname=params.nextElement().toString(); //System.out.println("name==========================="+name+ //"--"); //得到参数对应值 String[]value=req.getParameterValues(name); for(inti=0;i<value.length;i++) { sql=sql+value[i]; } } System.out.println("提交方式:"+req.getMethod()); System.out.println("被匹配字符串:"+sql); if(sqlValidate(sql)) { //传送json数据 JSONObjectjson=newJSONObject(); json.accumulate("message","恶意代码注入"); res.getWriter().print(json.toString()); } else { Stringrequest_uri=req.getRequestURI(); chain.doFilter(request,response); } } //校验 protectedstaticbooleansqlValidate(Stringstr) { str=str.toLowerCase();//统一转为小写 //StringbadStr="and|exec"; StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/"; /* *StringbadStr= *"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|" *+ *"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|" *+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#"; *///过滤掉的sql关键字,可以手动添加 String[]badStrs=badStr.split("\\|"); for(inti=0;i<badStrs.length;i++) { if(str.indexOf(badStrs[i])!=-1) { System.out.println("匹配到:"+badStrs[i]); returntrue; } } returnfalse; } publicvoidinit(FilterConfigfilterConfig)throwsServletException { //thrownewUnsupportedOperationException("Notsupportedyet."); } publicvoiddestroy() { //thrownewUnsupportedOperationException("Notsupportedyet."); } }
思路三:异常+跳转实现
这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话,抛出RuntimeException(),然后导致ajax请求失败,然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢?经过我认真思考之后,我们可以这样做,在session存一个error_messgae值,然后ajax请求的error方法跳转到错误页面,然后进行取值渲染错误页面。
ajax请求
$.ajax({ method:'post', url:'servlet/DemoServlet', dataType:'json', data:{ 'userName':userName, 'passWord':passWord, 'text':text }, success:function(data){ //成功之后的逻辑 }, error:function(){ window.location.href="error.jsp"; } });
防止SQL注入Filter
packagecom.yiyexiaoyuan.filter; importjava.io.IOException; importjava.util.Enumeration; importjavax.security.auth.message.callback.PrivateKeyCallback.Request; importjavax.servlet.Filter; importjavax.servlet.FilterChain; importjavax.servlet.FilterConfig; importjavax.servlet.ServletException; importjavax.servlet.ServletRequest; importjavax.servlet.ServletResponse; importjavax.servlet.http.HttpServletRequest; importjavax.servlet.http.HttpServletResponse; importnet.sf.json.JSONObject; //过滤sql关键字的Filter publicclassSQLFilterimplementsFilter { publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse, FilterChainchain)throwsIOException,ServletException { HttpServletRequestreq=(HttpServletRequest)request; HttpServletResponseres=(HttpServletResponse)response; //获得所有请求参数名 Enumerationparams=req.getParameterNames(); Stringsql=""; while(params.hasMoreElements()) { //得到参数名 Stringname=params.nextElement().toString(); //System.out.println("name==========================="+name+ //"--"); //得到参数对应值 String[]value=req.getParameterValues(name); for(inti=0;i<value.length;i++) { sql=sql+value[i]; } } System.out.println("提交方式:"+req.getMethod()); System.out.println("被匹配字符串:"+sql); if(sqlValidate(sql)) { req.getSession().setAttribute("error_message","恶意注入了"); thrownewRuntimeException("恶意注入"); } else { Stringrequest_uri=req.getRequestURI(); chain.doFilter(request,response); } } //校验 protectedstaticbooleansqlValidate(Stringstr) { str=str.toLowerCase();//统一转为小写 //StringbadStr="and|exec"; StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/"; /* *StringbadStr= *"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|" *+ *"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|" *+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#"; *///过滤掉的sql关键字,可以手动添加 String[]badStrs=badStr.split("\\|"); for(inti=0;i<badStrs.length;i++) { if(str.indexOf(badStrs[i])!=-1) { System.out.println("匹配到:"+badStrs[i]); returntrue; } } returnfalse; } publicvoidinit(FilterConfigfilterConfig)throwsServletException { //thrownewUnsupportedOperationException("Notsupportedyet."); } publicvoiddestroy() { //thrownewUnsupportedOperationException("Notsupportedyet."); } }
error.jsp实现
<%@pagelanguage="java"import="java.util.*"pageEncoding="UTF-8"%> <%@taglibprefix="c"uri="http://java.sun.com/jsp/jstl/core"%> <% Stringpath=request.getContextPath(); StringbasePath=request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/"; %> <!DOCTYPEHTMLPUBLIC"-//W3C//DTDHTML4.01Transitional//EN"> <html> <head> <basehref="<%=basePath%>"> <title>错误页面</title> <metahttp-equiv="pragma"content="no-cache"> <metahttp-equiv="cache-control"content="no-cache"> <metahttp-equiv="expires"content="0"> <metahttp-equiv="keywords"content="keyword1,keyword2,keyword3"> <metahttp-equiv="description"content="Thisismypage"> <!-- <linkrel="stylesheet"type="text/css"href="styles.css"> --> </head> <body> <center> 系统出错了,请稍后再试...... <br/> <br/> <br/> <br/> 错误信息是:${error_message} </center> </body> </html>
这样就很巧妙得实现了Filter拦截并友好提示。
以上所述是小编给大家介绍的Ajax请求和Filter配合案例解析,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对毛票票网站的支持!