package cn.palmte.work.security;

import top.jfunc.common.utils.ArrayUtil;
import top.jfunc.common.utils.StrUtil;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

/**
 * 过来特殊字符，防止URL框架注入漏洞
 */  
public class ReplaceSpecialCharFilter implements Filter {
    private String[] includes;

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException,ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        String requestURI = httpServletRequest.getRequestURI();
        if(ArrayUtil.contains(includes, requestURI)) {
            httpServletRequest = new XssHttpServletRequestWrapper(httpServletRequest);
        }
        filterChain.doFilter(httpServletRequest, response);
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        String includes = filterConfig.getInitParameter("includes");
        this.includes = StrUtil.isEmpty(includes)?new String[0]:includes.split(",");
    }

    @Override
    public void destroy() {}  

}
