Question

我正在尝试使用java / jsp中的Filter过滤掉名为'reason'的查询参数。

基本上，过滤器已到位，以确保用户输入了查看页面的“原因”。如果他们没有，则需要将它们重定向到“输入原因”页面。一旦他们输入了有效的理由，他们就可以继续访问他们要求的页面。

所以它的基础工作。但是，'reason'是通过查询paremter（即GET参数）发送的。用户选择原因后，会将原因参数转发到他们想要查看的页面。这是一个问题，因为检查原因是否存在参数是过滤器确定用户是否可以继续前进的主要方式之一。

我尝试扩展HttpServletRequestWrapper，并覆盖了一堆方法（例如getPameter等），以便删除'reason'参数。但是，我无法看到参数被删除。一旦过滤器转发到请求的页面，'reason'参数始终在查询字符串中（即浏览器URL栏中的url）作为GET参数。

我的过滤器类看起来像：

public final class AccessRequestFilter implements Filter {

    public class FilteredRequest extends HttpServletRequestWrapper {

        public FilteredRequest(ServletRequest request) {
            super((HttpServletRequest)request);
        }

        @Override
        public String getParameter(String paramName) {
            String value = super.getParameter(paramName);

            if ("reason".equals(paramName)) {
                value = null;
            }

            return value;
        }

        @Override
        public String[] getParameterValues(String paramName) {
            String[] values = super.getParameterValues(paramName);

            if ("reason".equals(paramName)) {
                values = null;
            }

            return values;
        }

        @Override
        public Enumeration<String> getParameterNames() {
            return Collections.enumeration(getParameterMap().keySet());
        }

        @Override
        public Map<String, String[]> getParameterMap() {            
            Map<String, String[]> params = new HashMap<String, String[]>();
            Map<String, String[]> originalParams = super.getParameterMap();

            for(Object o : originalParams.entrySet()) {
                Map.Entry<String, String[]> pairs = (Map.Entry<String, String[]>) o;
                params.put(pairs.getKey(), pairs.getValue());
            }

            params.remove("reason");

            return params;
        }

        @Override
        public String getQueryString() {
            String qs = super.getQueryString();

            return qs.replaceAll("reason=", "old_reason=");
        }

        @Override
        public StringBuffer getRequestURL() {
            String qs = super.getRequestURL().toString();

            return new StringBuffer( qs.replaceAll("reason=", "old_reason=") );
        }
    }

    private FilterConfig filterConfig = null;  
    private static final Logger logger = MiscUtils.getLogger();

    public void init(FilterConfig filterConfig) throws ServletException {  
        this.filterConfig = filterConfig;  
    }  

    public void destroy() {  
        this.filterConfig = null;  
    }  

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  
        logger.debug("Entering AccessRequestFilter.doFilter()");

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        HttpSession session = httpRequest.getSession();

        boolean canView = false;
        long echartAccessTime = 0L;
        String demographicNo = "";
        String reason = "";
        Date current = new Date();

        String user_no = (String) session.getAttribute("user");

        ProgramProviderDAO programProviderDAO = (ProgramProviderDAO)SpringUtils.getBean("programProviderDAO");
        ProgramQueueDao programQueueDao = (ProgramQueueDao)SpringUtils.getBean("programQueueDao");

        // Check to see if user has submitted a reason
        reason = request.getParameter("reason");
        demographicNo = request.getParameter("demographicNo");
        Long demographicNoAsLong = 0L;
        try {
            demographicNoAsLong = Long.parseLong( demographicNo );
        } catch (Exception e) {
            logger.error("Unable to parse demographic number.", e);
        }

        if (reason == null) {
            // If no reason was submitted, see if user still has time remaining on previous submission (if there was one)
            try {
                echartAccessTime = (Long)session.getServletContext().getAttribute("echartAccessTime_" + demographicNo);
            } catch (Exception e) {
                logger.warn("No access time found");
            }

            if (current.getTime() - echartAccessTime < 30000) {
                canView = true;
            }
        } else if (!reason.equals("")) {
            // TODO: validate reason
            canView = true;
            session.getServletContext().setAttribute("echartAccessTime_" + demographicNo, current.getTime());
            String ip = request.getRemoteAddr();
            // Log the access request and the reason given for access
            LogAction.addLog(user_no, "access", "eChart", demographicNo, ip, demographicNo, reason);
        }

        if (!canView) {
            // Check if provider is part of circle of care
            List<Long> programIds = new ArrayList<Long>();

            List<ProgramQueue> programQueues = programQueueDao.getAdmittedProgramQueuesByDemographicId( demographicNoAsLong );
            if (programQueues != null && programQueues.size() > 0) {
                for (ProgramQueue pq : programQueues) {
                    programIds.add( pq.getProgramId() );
                }

                List<ProgramProvider> programProviders = programProviderDAO.getProgramProviderByProviderProgramId(user_no, programIds);

                if (programProviders != null && programProviders.size() > 0) {
                    canView = true;
                }
            }
        }

        String useNewCaseMgmt;
        if((useNewCaseMgmt = request.getParameter("newCaseManagement")) != null ) {     
            session.setAttribute("newCaseManagement", useNewCaseMgmt); 
            ArrayList<String> users = (ArrayList<String>)session.getServletContext().getAttribute("CaseMgmtUsers");
            if( users != null ) {
                users.add(request.getParameter("providerNo"));
                session.getServletContext().setAttribute("CaseMgmtUsers", users);
            }
        }
        else {
            useNewCaseMgmt = (String)session.getAttribute("newCaseManagement");             
        }

        String requestURI = httpRequest.getRequestURI();
        String contextPath = httpRequest.getContextPath();

        if (!canView && !requestURI.startsWith(contextPath + "/casemgmt/accessRequest.jsp")) {
            httpResponse.sendRedirect(contextPath + "/casemgmt/accessRequest.jsp?" + httpRequest.getQueryString());
            return;
        }

        logger.debug("AccessRequestFilter chainning");
        chain.doFilter( new FilteredRequest(request), response);
    }
}

过滤器设置为拦截进入名为casemgmt的子目录的所有请求和转发。 web.xml中的过滤器类似于：

<filter>
        <filter-name>AccessRequestFilter</filter-name>
        <filter-class>org.oscarehr.casemgmt.filter.AccessRequestFilter</filter-class>
    </filter>
...
<filter-mapping>
        <filter-name>AccessRequestFilter</filter-name>
        <url-pattern>/casemgmt/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
    </filter-mapping>

任何人都有任何想法如何实际删除'reason'参数？

Answer 1

如在浏览器的地址栏中看到的那样，包装和操作服务器端的HttpServletRequest绝对不会神奇地影响URL。该URL保持原样，因为它是浏览器用于请求所需资源的URL。包装的请求只会影响在同一请求上过滤后运行的服务器端代码。

如果您想更改浏览器地址栏中的网址，那么您应该将重定向发送到所需的网址。

基本上，

if (reasonParameterIsIn(queryString)) {
    response.sendRedirect(requestURL + "?" + removeReasonParameterFrom(queryString));
    return;
}

HttpServletRequestWrapper删除的参数仍然显示出来

1 个答案: