java - HttpServletRequestWrapper 删除的参数仍然显示

Question

我正在尝试使用 java/jsp 中的过滤器过滤掉名为“reason”的查询参数。

基本上，过滤器的作用是确保用户输入查看页面的“原因”。如果他们没有，则需要将他们重定向到“输入原因”页面。一旦他们输入了有效的原因，他们就可以继续访问他们请求的页面。

所以它的基本原理是有效的。然而，“原因”是通过查询参数(即 GET 参数)发送的。一旦用户选择了原因，原因参数就会被转发到他们想要查看的页面。这是一个问题，因为检查原因参数是否存在是过滤器确定用户是否可以继续前进的主要方式之一。

我尝试扩展HttpServletRequestWrapper，并覆盖一堆方法(即getPameter等)，以删除“reason”参数。但是，我还没有看到该参数被删除。一旦过滤器转发到请求的页面，“reason”参数始终作为 GET 参数出现在查询字符串(即浏览器 URL 栏中的 URL)中。

我的过滤器类如下所示:

public final class AccessRequestFilter implements Filter {

    public class FilteredRequest extends HttpServletRequestWrapper {

        public FilteredRequest(ServletRequest request) {
            super((HttpServletRequest)request);
        }

        @Override
        public String getParameter(String paramName) {
            String value = super.getParameter(paramName);

            if ("reason".equals(paramName)) {
                value = null;
            }

            return value;
        }

        @Override
        public String[] getParameterValues(String paramName) {
            String[] values = super.getParameterValues(paramName);

            if ("reason".equals(paramName)) {
                values = null;
            }

            return values;
        }

        @Override
        public Enumeration<String> getParameterNames() {
            return Collections.enumeration(getParameterMap().keySet());
        }

        @Override
        public Map<String, String[]> getParameterMap() {            
            Map<String, String[]> params = new HashMap<String, String[]>();
            Map<String, String[]> originalParams = super.getParameterMap();

            for(Object o : originalParams.entrySet()) {
                Map.Entry<String, String[]> pairs = (Map.Entry<String, String[]>) o;
                params.put(pairs.getKey(), pairs.getValue());
            }

            params.remove("reason");

            return params;
        }

        @Override
        public String getQueryString() {
            String qs = super.getQueryString();

            return qs.replaceAll("reason=", "old_reason=");
        }

        @Override
        public StringBuffer getRequestURL() {
            String qs = super.getRequestURL().toString();

            return new StringBuffer( qs.replaceAll("reason=", "old_reason=") );
        }
    }

    private FilterConfig filterConfig = null;  
    private static final Logger logger = MiscUtils.getLogger();

    public void init(FilterConfig filterConfig) throws ServletException {  
        this.filterConfig = filterConfig;  
    }  

    public void destroy() {  
        this.filterConfig = null;  
    }  

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  
        logger.debug("Entering AccessRequestFilter.doFilter()");

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        HttpSession session = httpRequest.getSession();

        boolean canView = false;
        long echartAccessTime = 0L;
        String demographicNo = "";
        String reason = "";
        Date current = new Date();

        String user_no = (String) session.getAttribute("user");

        ProgramProviderDAO programProviderDAO = (ProgramProviderDAO)SpringUtils.getBean("programProviderDAO");
        ProgramQueueDao programQueueDao = (ProgramQueueDao)SpringUtils.getBean("programQueueDao");

        // Check to see if user has submitted a reason
        reason = request.getParameter("reason");
        demographicNo = request.getParameter("demographicNo");
        Long demographicNoAsLong = 0L;
        try {
            demographicNoAsLong = Long.parseLong( demographicNo );
        } catch (Exception e) {
            logger.error("Unable to parse demographic number.", e);
        }

        if (reason == null) {
            // If no reason was submitted, see if user still has time remaining on previous submission (if there was one)
            try {
                echartAccessTime = (Long)session.getServletContext().getAttribute("echartAccessTime_" + demographicNo);
            } catch (Exception e) {
                logger.warn("No access time found");
            }

            if (current.getTime() - echartAccessTime < 30000) {
                canView = true;
            }
        } else if (!reason.equals("")) {
            // TODO: validate reason
            canView = true;
            session.getServletContext().setAttribute("echartAccessTime_" + demographicNo, current.getTime());
            String ip = request.getRemoteAddr();
            // Log the access request and the reason given for access
            LogAction.addLog(user_no, "access", "eChart", demographicNo, ip, demographicNo, reason);
        }

        if (!canView) {
            // Check if provider is part of circle of care
            List<Long> programIds = new ArrayList<Long>();

            List<ProgramQueue> programQueues = programQueueDao.getAdmittedProgramQueuesByDemographicId( demographicNoAsLong );
            if (programQueues != null && programQueues.size() > 0) {
                for (ProgramQueue pq : programQueues) {
                    programIds.add( pq.getProgramId() );
                }

                List<ProgramProvider> programProviders = programProviderDAO.getProgramProviderByProviderProgramId(user_no, programIds);

                if (programProviders != null && programProviders.size() > 0) {
                    canView = true;
                }
            }
        }

        String useNewCaseMgmt;
        if((useNewCaseMgmt = request.getParameter("newCaseManagement")) != null ) {     
            session.setAttribute("newCaseManagement", useNewCaseMgmt); 
            ArrayList<String> users = (ArrayList<String>)session.getServletContext().getAttribute("CaseMgmtUsers");
            if( users != null ) {
                users.add(request.getParameter("providerNo"));
                session.getServletContext().setAttribute("CaseMgmtUsers", users);
            }
        }
        else {
            useNewCaseMgmt = (String)session.getAttribute("newCaseManagement");             
        }

        String requestURI = httpRequest.getRequestURI();
        String contextPath = httpRequest.getContextPath();

        if (!canView && !requestURI.startsWith(contextPath + "/casemgmt/accessRequest.jsp")) {
            httpResponse.sendRedirect(contextPath + "/casemgmt/accessRequest.jsp?" + httpRequest.getQueryString());
            return;
        }

        logger.debug("AccessRequestFilter chainning");
        chain.doFilter( new FilteredRequest(request), response);
    }
}

过滤器设置为拦截所有请求并转发到名为 casemgmt 的子目录。 web.xml 中的过滤器如下:

<filter>
        <filter-name>AccessRequestFilter</filter-name>
        <filter-class>org.oscarehr.casemgmt.filter.AccessRequestFilter</filter-class>
    </filter>
...
<filter-mapping>
        <filter-name>AccessRequestFilter</filter-name>
        <url-pattern>/casemgmt/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
    </filter-mapping>

有人知道如何真正删除“原因”参数吗？

Answer 1

在服务器端包装和操作 HttpServletRequest 绝对不会像您在浏览器地址栏中看到的那样神奇地影响 URL。该 URL 保持原样，因为它是浏览器用来请求所需资源的 URL。包装的请求只会影响在同一请求的过滤器之后运行的服务器端代码。

如果您想更改浏览器地址栏中的 URL，那么您应该发送重定向到所需的 URL。

基本上，

if (reasonParameterIsIn(queryString)) {
    response.sendRedirect(requestURL + "?" + removeReasonParameterFrom(queryString));
    return;
}