起因

线上项目突然遭到大量的非法参数攻击，由于历史问题，之前的代码从未对请求参数进行校验。 导致大量请求落到了数据访问层，给应用服务器和数据库都带来了很大压力。 针对这个问题，只能对请求真正到Controller方法调用之前直接将非法参数请求拒绝掉，所以在Filter中对参数进行统一校验，非法参数直接返回400。

定义参数检查规则：

1. 先检查uri是否需要拦截
2. 再检查请求参数是否合法：对于请求参数的检查，如果有值，不能存在非法值
3. 最后检查cookie是否正确：检查必须存在的cookie参数

代码示例

package com.lenovo.moc.portal.filter;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.lenovo.moc.portal.util.SessionUtil;
import com.lenovo.moc.portal.util.WebUtil;

/**
 * 检查请求参数过滤器<br />
 * 从2方面验证请求参数的有效性：检查cookie和请求参数 <br />
 * @date 2017年8月9日
 */
public class CheckRequestParamFilter implements Filter {
    private static final Logger logger = LoggerFactory.getLogger(CheckRequestParamFilter.class);
    private static final List<String> anonUriList = new ArrayList<String>(); // 不需要进行参数和cookie检查额uri列表
    {
        anonUriList.add("/home.do");
        anonUriList.add("/home_login_callback.do");
        anonUriList.add("/home_login_demo.do");
        anonUriList.add("/home_logout.do");
        anonUriList.add("/home_admin_logout.do");
    }

    public void init(FilterConfig filterConfig) throws ServletException {
        if(logger.isDebugEnabled()) {
            logger.debug("CheckRequestParamFilter init");
        }
    }

    // 参数和cookie检查
    // 1. 先检查uri是否需要拦截
    // 2. 再检查请求参数是否合法
    // 3. 最后检查cookie是否正确
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest)request;
        HttpServletResponse resp = (HttpServletResponse)response;
        
        String uri = req.getRequestURI();
        if(checkUri(req, resp, uri)) {
            chain.doFilter(request, response);
            return;
        }
        
        if(!checkParams(req, resp, uri)) {
            return;
        }
        
        if(!checkCookie(req, resp, uri)) {
            return;
        }
        
        chain.doFilter(request, response);
    }

    /**
     * 检查uri是否需要检查参数
     * @param req
     * @param resp
     * @param uri
     * @return 不需要检查,返回true; 否则返回false.
     */
    private boolean checkUri(HttpServletRequest req, HttpServletResponse resp, String uri) {
        if(logger.isDebugEnabled()) {
            logger.debug("request uri: {}", uri.trim());
        }
        
        uri = uri.substring(req.getContextPath().length());
        return anonUriList.contains(uri.trim());
    }
    
    /**
     * 请求参数如果不为空，则不能包含特殊字符
     * @param req
     * @param resp
     * @param uri
     * @return
     */
    private boolean checkParams(HttpServletRequest req, HttpServletResponse resp, String uri) {
        Enumeration<?> enumeration = req.getParameterNames();
        while(enumeration.hasMoreElements()) {
            String key = enumeration.nextElement().toString();
            Object value = req.getParameter(key);
            if(value == null || "".equals(value.toString().trim())) {
                continue;
            }
            
            if(containsInvalidChars(value.toString())) {
                logger.error("request param value contains invalid chars! param name: {}, param value: {}, uri: {}", key, value, uri);
                return false;
            }
            
            if(containsInvalidString(value.toString())) {
                logger.error("request param value contains invalid string! parma name: {}, param value: {}, uri: {}", key, value, uri);
                return false;
            }
        }
        
        if(logger.isDebugEnabled()) {
            logger.debug("check all request parameters are valid, uri: {}", uri);
        }
        return true;
    }
    
    /**
     * 检查是否包含特殊字符
     * @param value
     * @return
     */
    private static boolean containsInvalidChars(String value) {
        String regex = "[`~!#$%^&()|{}';'\\[\\]<>?~！#￥%……&（）——|{}【】‘；：”“’。，、？]";
        Pattern pattern = Pattern.compile(regex);
        Matcher matcher = pattern.matcher(value);
        return matcher.find();
    }
    
    /**
     * 检查是否包含特殊字符串
     * @param value
     * @return
     */
    private static boolean containsInvalidString(String value) {
        return value.contains("select") ||
               value.contains("nslookup")  ||
               value.contains("sleep");
    }

    /**
     * 指定cookie必须存在
     * @param req
     * @param resp
     * @param uri
     * @return
     * @throws IOException
     */
    private boolean checkCookie(HttpServletRequest req, HttpServletResponse resp, String uri) throws IOException {
        Map<String, String> cookieMap = new HashMap<String, String>();
        Cookie[] cookies = req.getCookies();
        for(Cookie c : cookies) {
            cookieMap.put(c.getName(), c.getValue());
        }
        
        // 检查SessionUtil.LOGIN_STAFF_ID
        String loginStaffId = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_STAFF_ID));
        if(loginStaffId == null) {
            logger.error("login staff id cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_COMPANY_ID
        String loginCompanyId = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_COMPANY_ID));
        if(loginCompanyId == null) {
            logger.error("login company id cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_COMPANY_NAME
        String loginCompanyName = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_COMPANY_NAME));
        if(loginCompanyName == null) {
            logger.error("login company name cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_USER_NAME
        String loginUserName = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_NAME));
        if(loginUserName == null) {
            logger.error("login user name cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_USER_ACCOUNT
        String loginUserAccount = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ACCOUNT));
        if(loginUserAccount == null) {
            logger.error("login user account cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_USER_ROLE
        String loginUserRole = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ROLE));
        if(loginUserRole == null) {
            logger.error("login user role cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        // 检查SessionUtil.LOGIN_USER_ROLE_CODE
        String loginUserCode = cookieMap.get(WebUtil.md5(SessionUtil.LOGIN_USER_ROLE_CODE));
        if(loginUserCode == null) {
            logger.error("login user role code cookie NOT FOUND! uri: {}", uri);
            deny(req, resp, "invalid param");
            return false;
        }
        
        if(logger.isDebugEnabled()) {
            logger.debug("check all cookies are valid, uri: {}", uri);
        }
        return true;
    }
    
    /**
     * 断开与客户端的连接
     * @param req
     * @param resp
     * @param message
     * @throws IOException
     */
    private void deny(HttpServletRequest req, HttpServletResponse resp, String message) throws IOException {
        resp.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        resp.getWriter().write(message);
        resp.getWriter().close();
    }

    public void destroy() {
    }

}