在spring cloud 框架中添加过滤器，对json格式的请求数据进行过滤进行防sql注入（只对一层json有效）

请求数据json只能是一层，多层嵌套的json数据不支持，有大牛知道怎么解决的可以提出来，谢谢

import com.netflix.zuul.ZuulFilter;

import com.netflix.zuul.context.RequestContext;

import com.netflix.zuul.http.ServletInputStreamWrapper;

import lombok.extern.slf4j.Slf4j;

import net.sf.json.JSONObject;

import org.springframework.cloud.context.config.annotation.RefreshScope;

import org.springframework.stereotype.Component;

import org.springframework.util.StreamUtils;

 

import javax.servlet.ServletInputStream;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import java.io.IOException;

import java.io.InputStream;

import java.nio.charset.Charset;

import java.util.HashMap;

import java.util.Map;

 

 

/**

* 对请求json参数进行防sql注入过滤

*

* @create 2018-12-18

*/

@Component

@Slf4j

@RefreshScope

public class SqLinjectionFilter extends ZuulFilter {

@Override

public String filterType() {

return "pre";

}

 

@Override

public int filterOrder() {

return -3;

}

 

@Override

public boolean shouldFilter() {

return true;

}

 

@Override

public Object run() {

RequestContext ctx = RequestContext.getCurrentContext();

HttpServletRequest request = ctx.getRequest();

try {

InputStream in = ctx.getRequest().getInputStream();

String body = StreamUtils.copyToString(in, Charset.forName("UTF-8"));

Map stringObjectMap = cleanXSS(body);

JSONObject json = JSONObject.fromObject(stringObjectMap);

String newBody = json.toString();

final byte[] reqBodyBytes = newBody.getBytes();

ctx.setRequest(new HttpServletRequestWrapper(request){

@Override

public ServletInputStream getInputStream() throws IOException {

return new ServletInputStreamWrapper(reqBodyBytes);

}

@Override

public int getContentLength() {

return reqBodyBytes.length;

}

@Override

public long getContentLengthLong() {

return reqBodyBytes.length;

}

});

} catch (IOException e) {

e.printStackTrace();

}

return null;

}

private Map cleanXSS(String value) {

//You'll need to remove the spaces from the html entities below

value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");

value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");

value = value.replaceAll("'", "& #39;");

value = value.replaceAll("eval\\((.*)\\)", "");

value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

value = value.replaceAll("script", "");

value = value.replaceAll("[*]","["+"*]");

value = value.replaceAll("[+]","["+"+]");

value = value.replaceAll("[?]","["+"?]");

 

String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|%|chr|mid|master|truncate|" +

"char|declare|sitename|net user|xp_cmdshell|;|or|+|,|like'|and|exec|execute|insert|create|drop|" +

"table|from|grant|use|group_concat|column_name|" +

"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|" +

"chr|mid|master|truncate|char|declare|or|;|--|,|like|//|/|%|#";

JSONObject json = JSONObject.fromObject(value);

String[] badStrs = badStr.split("\\|");

Map map=json;

Map mapjson=new HashMap<>();

for (Map.Entry entry : map.entrySet()) {

String value1 = (String) entry.getValue();

for (String bad :badStrs){

if (value1.equalsIgnoreCase(bad)){

value1="forbid";

mapjson.put(entry.getKey(),value1);

break;

}else {

mapjson.put(entry.getKey(),entry.getValue());

}

}

}

return mapjson;

}

}