filterchain1.配置web &

1.配置web

   <filter>  
     <filter-name>XssSqlFilter</filter-name>  
     <filter-class>com.modules.sys.security.SessionFilter</filter-class>  //的位置
  </filter>  
    <filter-mapping>  
     <filter-name>XssSqlFilter</filter-name>  
     <url-pattern>/*</url-pattern>  
  </filter-mapping>

2.代码

  
import java.io.IOException;  
import java.util.Iterator;  
import java.util.Map;  
import javax.servlet.Filter;  
import javax.servlet.FilterChain;  
import javax.servlet.FilterConfig;  
import javax.servlet.ServletException;  
import javax.servlet.ServletRequest;  
import javax.servlet.ServletResponse;  
import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletResponse;  
import org.apache.commons.lang.StringUtils;  
import org.apache.log4j.Logger;  
  
  
public class SessionFilter implements Filter {  
    private static Logger log = Logger.getLogger(SessionFilter.class);  
  
    public void destroy() { }  
  
    public void doFilter(ServletRequest servletRequest,  
            ServletResponse servletResponse, FilterChain filterChain)  
            throws IOException, ServletException {  
        HttpServletRequest request = (HttpServletRequest) servletRequest;  
        HttpServletResponse response = (HttpServletResponse) servletResponse;  
        String requestStr = getRequestString(request);  
        System.out.println("requestStr： ======================== " + requestStr);  
        System.out.println("完整的地址是====" + request.getRequestURL().toString());  
        System.out.println("提交的方式是========" + request.getMethod());  
        log.info("requestStr： ======================== " + requestStr);  
        log.info("完整的地址是====" + request.getRequestURL().toString());
        log.info("提交的方式是========" + request.getMethod());  
  
        if ("bingo".equals(guolv2(requestStr))  
                || "bingo".equals(guolv2(request.getRequestURL().toString()))) {  
            System.out.println("======访问地址发现非法字符，已拦截======");  
            log.info("======访问地址发现非法字符，已拦截======其非法地址为："+guolv2(request.getRequestURL().toString()));  
            response.sendRedirect(request.getContextPath() + "/login.jsp");  
            return;  
        }  
        // 主机ip和端口 或 域名和端口  
        String myhosts = request.getHeader("host");  
        if (!StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")  
                && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")  
                && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")  
                && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")  
                && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")  
                && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")) {  
            System.out.println("======访问host非法，已拦截======其非法host为:"+myhosts);  
            log.info("======访问host非法，已拦截======其非法host为:"+myhosts);  
            response.sendRedirect(request.getContextPath() + "/login.jsp");   //或者??response.setStatus(403); 

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-69452-1.html