org.frameworkset.util.ReferHelper Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of bboss-util Show documentation

bboss is a j2ee framework include aop/ioc,mvc,persistent,taglib,rpc,event ,bean-xml serializable and so on.http://www.bbossgroups.com

The newest version!

package org.frameworkset.util;

import com.frameworkset.util.StringUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ReferHelper {
	private static Logger logger = LoggerFactory.getLogger(ReferHelper.class);
	private String[] refererwallwhilelist;
	/**
	 * 请求参数不编码url白名单
	 */
	private String[] encodeParameterWhileList;
	public static final String REQUEST_HEADER_REFER_CHECKED = "REQUEST_HEADER_REFER_CHECKED";
	// -------------------------------------------------- CORS Request Headers
	/**
	 * The Origin header indicates where the cross-origin request or preflight
	 * request originates from.
	 */
	public static final String REQUEST_HEADER_ORIGIN = "Origin";
	/**
	 * The Access-Control-Request-Headers header indicates which headers will be
	 * used in the actual request as part of the preflight request.
	 */
	public static final String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS =
			"Access-Control-Request-Headers";

	private boolean refererDefender = false;
	private PathMatcher pathMatcher;
//	private String[] wallfilterrules;
//	private String[] wallwhilelist;
	private AttackFielterPolicy attackFielterPolicy;
	public final static String[] wallfilterrules_default = new String[] {
			" 0){
//				for(String whiteUrl:whiteList){
//					disable = pathMatcher.urlMatch(whiteUrl,uri);
//					if(disable){
//						break;
//					}
//				}
//			}
//		}
		return disable;
	}

	/**
	 * 敏感词扫描
	 * @param name
	 * @param values
	 * @param attackContext
	 */
	public void sensitiveWallfilter(String name, String[] values,AttackContext attackContext) {
		if(attackFielterPolicy.isDisable()){
			return;
		}
		String[] wallfilterrules = this.getSensitiveFilterrules();

		if (wallfilterrules == null || wallfilterrules.length == 0
				|| values == null || values.length == 0 || isSensitiveWhilename(name))
			return;

		int j = 0;
		for (String value : values) {
			if (value == null || value.equals("")) {
				j++;
				continue;
			}

			for (int i = 0; i < wallfilterrules.length; i++) {

				if (attackFielterPolicy.sensitiveCheck(value,wallfilterrules[i])) {
					attackContext.setParamName(name);
					attackContext.setValues(values);
					attackContext.setPosition(j);
					attackContext.setAttackRule(wallfilterrules[i]);
					attackContext.setAttackType(AttackContext.SENSITIVE_ATTACK);
					attackFielterPolicy.attackHandle(attackContext);
					break;
				}
			}
			j++;

		}
	}

	public String[] getEncodeParameterWhileList() {
		return encodeParameterWhileList;
	}

	public void setEncodeParameterWhileList(String[] encodeParameterWhileList) {
		this.encodeParameterWhileList = encodeParameterWhileList;
	}
}