获取request输入流

我们在进行请求进行拦截的时候经常会碰上这样一个问题&＃xff0c;我们想要在拦截器filter中获取request的请求&＃xff0c;如果使用请求中默认的getInputStream()方法或者getReader()方法获取数据&＃xff0c;但是在后面的Controller中使用&＃64;ResquestBody注解&＃xff0c;我们读取不到request的body中的值&＃xff0c;这是因为request的body中的数据只能通过getInputStream()和getReader()方法读取一次&＃xff0c;要解决这个问题&＃xff0c;我们要对重写request请求的getInputStream()和getReader()方法。

一般在POST请求中我们携带的信息是application/json格式的。在一些场景中我们要对这些POST请求中的application/json信息进行获取、解析。
先看代码&＃xff1a;

public class XssRequestWrapper extends HttpServletRequestWrapper {private static Policy policy &＃61; null;private static final AntiSamy antiSamy &＃61; new AntiSamy();/*** 请求Body中的String类型*/private String body;/*** application/json转成的Map类型*/private Map<String, String> parameters &＃61; new HashMap<String, String>();/*** 字符串的流*/private byte[] bytes;/*** 判断是否进行了数据的初始化*/private boolean isInit &＃61; false;/*** 默认的字符串格式*/private static final String DEFAULT_CHARSET_NAME &＃61; "UTF-8";private ObjectMapper objectMapper &＃61; new ObjectMapper();public XssRequestWrapper(HttpServletRequest request) throws IOException {super(request);try {String contentType &＃61; request.getContentType();if(contentType.contains(";")){contentType &＃61; contentType.substring(0,contentType.indexOf(";"));}//初始化bytes中的数据initBytes();//解析application/json中的内容if(contentType.equals(MediaType.APPLICATION_JSON_VALUE)){parseJsonParameters();}} catch (IOException e) {throw new RuntimeException("IOException", e);}}/*** 第一次执行要进行数据的初始化* &＃64;throws IOException*/private void initBytes() throws IOException {isInit &＃61; true;StringBuilder buffer &＃61; new StringBuilder();BufferedReader reader &＃61; this.getHttpServletRequest().getReader();String line;while ((line &＃61; reader.readLine()) !&＃61; null) {buffer.append(line);}body &＃61; buffer.toString();//获取输入流到本地bytes &＃61; body.getBytes(DEFAULT_CHARSET_NAME);}/*** 解析ApplicationJson数据&＃xff0c;并且经过XSS过滤* &＃64;throws IOException*/private void parseJsonParameters() throws IOException {StringBuilder stringBuilder &＃61; new StringBuilder("{");if (null !&＃61; body && body.length() > 0) {JsonNode node &＃61; objectMapper.readTree(body);Iterator<String> fieldNames &＃61; node.getFieldNames();for (; fieldNames.hasNext();) {String key &＃61; fieldNames.next();String value &＃61; node.get(key).toString();if (value.length() > 2 && value.startsWith("\"")) {String valueTemp &＃61; value.substring(1,value.length()-1);valueTemp &＃61; StringEscapeUtils.unescapeJava(valueTemp);//TODO:XSS白名单过滤valueTemp &＃61; StringEscapeUtils.escapeJava(valueTemp);valueTemp &＃61; "\"" &＃43; valueTemp &＃43; "\"";parameters.put(key, valueTemp);} else {parameters.put(key, value);}}}for(String key:parameters.keySet()){String value &＃61; parameters.get(key);stringBuilder.append("\""&＃43;key&＃43;"\":"&＃43;value&＃43;",");}stringBuilder.deleteCharAt(stringBuilder.length()-1);stringBuilder.append("}");try {bytes &＃61; stringBuilder.toString().getBytes(DEFAULT_CHARSET_NAME);} catch (UnsupportedEncodingException e) {e.printStackTrace();}}private HttpServletRequest getHttpServletRequest() {return (HttpServletRequest) super.getRequest();}/*** 重写getReader方法* &＃64;return* &＃64;throws IOException*/&＃64;Overridepublic BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));}/*** 重写getInputStream()方法* 可以修改body内容* &＃64;return* &＃64;throws IOException*/&＃64;Overridepublic ServletInputStream getInputStream() throws IOException {if (!isInit)initBytes();final ByteArrayInputStream bais &＃61; new ByteArrayInputStream(bytes);return new ServletInputStream() {&＃64;Overridepublic int read() throws IOException {return bais.read();}};}

总结

分析&＃xff1a;获取Post请求输入流&＃xff0c;又保证数据不丢失的步骤如下&＃xff1a;

• 继承父类的构造方法&＃xff0c;在自己的方法中进行数据的初始化
• 数据的初始化就是&＃xff0c;获取输入流&＃xff0c;写入本类的char[] bytes中
• 重新getInputStream()方法和getReader()方法&＃xff0c;其中getInputStream()方法直接读取bytes字节流信息
• 解析application/json数据&＃xff0c;利用JsonNode类