Heim >Web-Frontend >js-Tutorial >Ajax-Anfrage und Filteranalyse
Ajax-Anfrage und Filteranalyse
- php中世界最好的语言Original
- 2018-04-03 09:53:151289Durchsuche
这次给大家带来Ajax请求与Filter解析，Ajax请求与Filter解析的注意事项有哪些，下面就是实战案例，一起来看一下。
案例引入
现在有这样一个问题，就是在提交大片文字评论的时候，前台拿到数据之后给后台发送ajax请求，然后后台有一个防止SQL注入的Filter，这个Filter得到这个前台传过来的数据之后，进行合法性校验，如果没有校验成功，那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。
思路一：请求转发实现
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text': text
},
success:function(data){
//成功之后的逻辑
},
error:function(){
//错误之后的逻辑
}
});
防止SQL注入Filter
package com.yiyexiaoyuan.filter;
import java.io.IOException;
import java.util.Enumeration;
import javax.security.auth.message.callback.PrivateKeyCallback.Request;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
//过滤sql关键字的Filter
public class SQLFilter implements Filter
{
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException
{
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
// 获得所有请求参数名
Enumeration params = req.getParameterNames();
String sql = "";
while (params.hasMoreElements())
{
// 得到参数名
String name = params.nextElement().toString();
// System.out.println("name===========================" + name +
// "--");
// 得到参数对应值
String[] value = req.getParameterValues(name);
for (int i = 0; i < value.length; i++)
{
sql = sql + value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串：" + sql);
if (sqlValidate(sql))
{
//请求转发
req.getRequestDispatcher("error.jsp").
forward(req, res);
}
else
{
String request_uri = req.getRequestURI();
chain.doFilter(request, response);
}
}
// 校验
protected static boolean sqlValidate(String str)
{
str = str.toLowerCase();// 统一转为小写
// String badStr = "and|exec";
String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
* String badStr =
* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
* +
* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*/// 过滤掉的sql关键字，可以手动添加
String[] badStrs = badStr.split("\\|");
for (int i = 0; i < badStrs.length; i++)
{
if (str.indexOf(badStrs[i]) != -1)
{
System.out.println("匹配到：" + badStrs[i]);
return true;
}
}
return false;
}
public void init(FilterConfig filterConfig) throws ServletException
{
// throw new UnsupportedOperationException("Not supported yet.");
}
public void destroy()
{
// throw new UnsupportedOperationException("Not supported yet.");
}
}web.xml配置
<filter> <display-name>SQLFilter</display-name> <filter-name>SQLFilter</filter-name> <filter-class>com.yiyexiaoyuan.filter.SQLFilter</filter-class> </filter> <filter-mapping> <filter-name>SQLFilter</filter-name> <url-pattern>/servlet/*</url-pattern> </filter-mapping> <filter>
分析，ajax请求DemoServlet，然后请求先被防止SQL注入这个Filter过滤器先过滤，然后过滤到的请求参数构成一个匹配字符串，然后检查是否是恶意代码，如果是的话，请求转发。但是很遗憾，逻辑上这个是对的，但是ajax请求是局部刷新的，最后是要回到ajax请求发起的这个页面的，所以请求转发不会实现，我们看下一种实现逻辑。
思路二：返回值进行判断
这个思路的逻辑是这样的：在Filter过滤掉信息的时候，给ajax请求回送一个json数据，然后返回给前台，前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text': text
},
success:function(data){
//成功之后的逻辑
if (data.mssage!=""){
//执行处理恶意代码的逻辑
}
else{
}
},
error:function(){
//错误之后的逻辑
}
});
防止SQL注入的Filter
package com.yiyexiaoyuan.filter;
import java.io.IOException;
import java.util.Enumeration;
import javax.security.auth.message.callback.PrivateKeyCallback.Request;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
//过滤sql关键字的Filter
public class SQLFilter implements Filter
{
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException
{
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
// 获得所有请求参数名
Enumeration params = req.getParameterNames();
String sql = "";
while (params.hasMoreElements())
{
// 得到参数名
String name = params.nextElement().toString();
// System.out.println("name===========================" + name +
// "--");
// 得到参数对应值
String[] value = req.getParameterValues(name);
for (int i = 0; i < value.length; i++)
{
sql = sql + value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串：" + sql);
if (sqlValidate(sql))
{
//传送json数据
JSONObject json = new JSONObject();
json.accumulate("message", "恶意代码注入");
res.getWriter().print(json.toString());
}
else
{
String request_uri = req.getRequestURI();
chain.doFilter(request, response);
}
}
// 校验
protected static boolean sqlValidate(String str)
{
str = str.toLowerCase();// 统一转为小写
// String badStr = "and|exec";
String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
* String badStr =
* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
* +
* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*/// 过滤掉的sql关键字，可以手动添加
String[] badStrs = badStr.split("\\|");
for (int i = 0; i < badStrs.length; i++)
{
if (str.indexOf(badStrs[i]) != -1)
{
System.out.println("匹配到：" + badStrs[i]);
return true;
}
}
return false;
}
public void init(FilterConfig filterConfig) throws ServletException
{
// throw new UnsupportedOperationException("Not supported yet.");
}
public void destroy()
{
// throw new UnsupportedOperationException("Not supported yet.");
}
}思路三：异常+跳转实现
这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话，抛出RuntimeException()，然后导致ajax请求失败，然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢？经过我认真思考之后，我们可以这样做，在session存一个error_messgae值，然后ajax请求的error方法跳转到错误页面，然后进行取值渲染错误页面。
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text': text
},
success:function(data){
//成功之后的逻辑
},
error:function(){
window.location.href="error.jsp";
}
});防止SQL注入Filter
package com.yiyexiaoyuan.filter;
import java.io.IOException;
import java.util.Enumeration;
import javax.security.auth.message.callback.PrivateKeyCallback.Request;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
//过滤sql关键字的Filter
public class SQLFilter implements Filter
{
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException
{
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
// 获得所有请求参数名
Enumeration params = req.getParameterNames();
String sql = "";
while (params.hasMoreElements())
{
// 得到参数名
String name = params.nextElement().toString();
// System.out.println("name===========================" + name +
// "--");
// 得到参数对应值
String[] value = req.getParameterValues(name);
for (int i = 0; i < value.length; i++)
{
sql = sql + value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串：" + sql);
if (sqlValidate(sql))
{
req.getSession().setAttribute("error_message","恶意注入了");
throw new RuntimeException("恶意注入");
}
else
{
String request_uri = req.getRequestURI();
chain.doFilter(request, response);
}
}
// 校验
protected static boolean sqlValidate(String str)
{
str = str.toLowerCase();// 统一转为小写
// String badStr = "and|exec";
String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
* String badStr =
* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
* +
* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*/// 过滤掉的sql关键字，可以手动添加
String[] badStrs = badStr.split("\\|");
for (int i = 0; i < badStrs.length; i++)
{
if (str.indexOf(badStrs[i]) != -1)
{
System.out.println("匹配到：" + badStrs[i]);
return true;
}
}
return false;
}
public void init(FilterConfig filterConfig) throws ServletException
{
// throw new UnsupportedOperationException("Not supported yet.");
}
public void destroy()
{
// throw new UnsupportedOperationException("Not supported yet.");
}
}error.jsp实现
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>错误页面</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
-->
</head>
<body>
<center>
系统出错了，请稍后再试......
<br />
<br />
<br />
<br />
错误信息是: ${ error_message}
</center>
</body>
</html>
这样就很巧妙得实现了Filter拦截并友好提示。
相信看了本文案例你已经掌握了方法，更多精彩请关注php中文网其它相关文章！
推荐阅读：
Das obige ist der detaillierte Inhalt vonAjax-Anfrage und Filteranalyse. Für weitere Informationen folgen Sie bitte anderen verwandten Artikeln auf der PHP chinesischen Website!
Stellungnahme：
Der Inhalt dieses Artikels wird freiwillig von Internetnutzern beigesteuert und das Urheberrecht liegt beim ursprünglichen Autor. Diese Website übernimmt keine entsprechende rechtliche Verantwortung. Wenn Sie Inhalte finden, bei denen der Verdacht eines Plagiats oder einer Rechtsverletzung besteht, wenden Sie sich bitte an admin@php.cn
Vorheriger Artikel：So leeren Sie den Cache in AjaxNächster Artikel：So leeren Sie den Cache in Ajax
In Verbindung stehende Artikel
Mehr sehen- Eine eingehende Analyse der Bootstrap-Listengruppenkomponente
- Detaillierte Erläuterung des JavaScript-Funktions-Curryings
- Vollständiges Beispiel für die Generierung von JS-Passwörtern und die Erkennung der Stärke (mit Download des Demo-Quellcodes)
- Angularjs integriert WeChat UI (weui)
- Wie man mit JavaScript schnell zwischen traditionellem Chinesisch und vereinfachtem Chinesisch wechselt und wie Websites den Wechsel zwischen vereinfachtem und traditionellem Chinesisch unterstützen – Javascript-Kenntnisse