Springboot 全局异常处理

古城微笑少年丶 2022-04-05 13:46 524阅读 0赞

最近在做项目时需要对异常进行全局统一处理，主要是一些分类入库以及记录日志等，因为项目是基于Springboot的，所以去网络上找了一些博客文档，然后再结合项目本身的一些特殊需求做了些许改造，现在记录下来便于以后查看。

在网络上找到关于Springboot全局异常统一处理的文档博客主要是两种方案：

1、基于@ControllerAdvice注解的Controller层的全局异常统一处理

以下是网上一位博主给出的代码示例，该博客地址为：https://www.cnblogs.com/magicalSam/p/7198420.html

import org.springframework.ui.Model;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.*;

import java.util.HashMap;
import java.util.Map;

/**
* controller 增强器
*
* @author sam
* @since 2017/7/17
*/
@ControllerAdvice
public class MyControllerAdvice { 

  1. /\*\*  
  2.  \* 全局异常捕捉处理  
  3.  \* @param ex  
  4.  \* @return  
  5.  \*/  
  6. @ResponseBody  
  7. @ExceptionHandler(value = Exception.class)  
  8. public Map errorHandler(Exception ex) \{  
  9.     Map map = new HashMap();  
  10.     map.put("code", 100);  
  11.     map.put("msg", ex.getMessage());  
  12.     return map;  
  13. \}  
  15. /\*\*  
  16.  \* 拦截捕捉自定义异常 MyException.class  
  17.  \* @param ex  
  18.  \* @return  
  19.  \*/  
  20. @ResponseBody  
  21. @ExceptionHandler(value = MyException.class)  
  22. public Map myErrorHandler(MyException ex) \{  
  23.     Map map = new HashMap();  
  24.     map.put("code", ex.getCode());  
  25.     map.put("msg", ex.getMsg());  
  26.     return map;  
  27. \}

}
这个代码示例写的非常浅显易懂，但是需要注意的是：基于@ControllerAdvice注解的全局异常统一处理只能针对于Controller层的异常，意思是只能捕获到Controller层的异常，在service层或者其他层面的异常都不能捕获。

根据这段示例代码以及结合项目本身的实际需求，对该实例代码做了稍微改造（其实几乎没做改造，只是业务处理不一样而已）：

@ControllerAdvice
public class AdminExceptionHandler { 

  1. private static final Logger logger = LoggerFactory.getLogger(AdminExceptionHandler.class);  
  3. /\*\*  
  4.   \* @Author: gmy  
  5.   \* @Description: 系统异常捕获处理  
  6.   \* @Date: 16:07 2018/5/30  
  7.   \*/  
  8. @ResponseBody  
  9. @ExceptionHandler(value = Exception.class)  
  10. public APIResponse javaExceptionHandler(Exception ex) \{//APIResponse是项目中对外统一的出口封装，可以根据自身项目的需求做相应更改  
  11.     logger.error("捕获到Exception异常",ex);  
  12.     //异常日志入库  
  14.     return new APIResponse(APIResponse.FAIL,null,ex.getMessage());  
  15. \}  
  17. /\*\*  
  18.   \* @Author: gmy  
  19.   \* @Description: 自定义异常捕获处理  
  20.   \* @Date: 16:08 2018/5/30  
  21.   \*/  
  22. @ResponseBody  
  23. @ExceptionHandler(value = MessageCenterException.class)//MessageCenterException是自定义的一个异常  
  24. public APIResponse messageCenterExceptionHandler(MessageCenterException ex) \{  
  25.     logger.error("捕获到MessageCenterException异常",ex.getException());  
  26.     //异常日志入库  
  28.     return ex.getApiResponse();  
  29. \}

}
public class MessageCenterException extends RuntimeException { 

  1. public MessageCenterException(APIResponse apiResponse, Exception exception)\{  
  2.     this.apiResponse = apiResponse;  
  3.     this.exception = exception;  
  4. \}  
  6. private Exception exception;  
  7. private APIResponse apiResponse;  
  9. public Exception getException() \{  
  10.     return exception;  
  11. \}  
  13. public void setException(Exception exception) \{  
  14.     this.exception = exception;  
  15. \}  
  17. public APIResponse getApiResponse() \{  
  18.     return apiResponse;  
  19. \}  
  21. public void setApiResponse(APIResponse apiResponse) \{  
  22.     this.apiResponse = apiResponse;  
  23. \}

}
经过测试发现可以捕获到Controller层的异常，当前前提是Controller层没有对异常进行catch处理，如果Controller层对异常进行了catch处理，那么在这里就不会捕获到Controller层的异常了，所以这一点要特别注意。

在实际测试中还发现，如果在Controller中不做异常catch处理，在service中抛出异常（service中也不错异常catch处理），那么也是可以在这里捕获到异常的。

2、基于Springboot自身的全局异常统一处理，主要是实现ErrorController接口或者继承AbstractErrorController抽象类或者继承BasicErrorController类

以下是网上一位博主给出的示例代码，博客地址为：https://blog.csdn.net/king\_is\_everyone/article/details/53080851

@Controller
@RequestMapping(value = “error”)
@EnableConfigurationProperties({ServerProperties.class})
public class ExceptionController implements ErrorController { 

  1. private ErrorAttributes errorAttributes;  
  3. @Autowired  
  4. private ServerProperties serverProperties;  
  7. /\*\*  
  8.  \* 初始化ExceptionController  
  9.  \* @param errorAttributes  
  10.  \*/  
  11. @Autowired  
  12. public ExceptionController(ErrorAttributes errorAttributes) \{  
  13.     Assert.notNull(errorAttributes, "ErrorAttributes must not be null");  
  14.     this.errorAttributes = errorAttributes;  
  15. \}  
  18. /\*\*  
  19.  \* 定义404的ModelAndView  
  20.  \* @param request  
  21.  \* @param response  
  22.  \* @return  
  23.  \*/  
  24. @RequestMapping(produces = "text/html",value = "404")  
  25. public ModelAndView errorHtml404(HttpServletRequest request,  
  26.                               HttpServletResponse response) \{  
  27.     response.setStatus(getStatus(request).value());  
  28.     Map<String, Object> model = getErrorAttributes(request,  
  29.             isIncludeStackTrace(request, MediaType.TEXT\_HTML));  
  30.     return new ModelAndView("error/404", model);  
  31. \}  
  33. /\*\*  
  34.  \* 定义404的JSON数据  
  35.  \* @param request  
  36.  \* @return  
  37.  \*/  
  38. @RequestMapping(value = "404")  
  39. @ResponseBody  
  40. public ResponseEntity<Map<String, Object>> error404(HttpServletRequest request) \{  
  41.     Map<String, Object> body = getErrorAttributes(request,  
  42.             isIncludeStackTrace(request, MediaType.TEXT\_HTML));  
  43.     HttpStatus status = getStatus(request);  
  44.     return new ResponseEntity<Map<String, Object>>(body, status);  
  45. \}  
  47. /\*\*  
  48.  \* 定义500的ModelAndView  
  49.  \* @param request  
  50.  \* @param response  
  51.  \* @return  
  52.  \*/  
  53. @RequestMapping(produces = "text/html",value = "500")  
  54. public ModelAndView errorHtml500(HttpServletRequest request,  
  55.                               HttpServletResponse response) \{  
  56.     response.setStatus(getStatus(request).value());  
  57.     Map<String, Object> model = getErrorAttributes(request,  
  58.             isIncludeStackTrace(request, MediaType.TEXT\_HTML));  
  59.     return new ModelAndView("error/500", model);  
  60. \}  
  63. /\*\*  
  64.  \* 定义500的错误JSON信息  
  65.  \* @param request  
  66.  \* @return  
  67.  \*/  
  68. @RequestMapping(value = "500")  
  69. @ResponseBody  
  70. public ResponseEntity<Map<String, Object>> error500(HttpServletRequest request) \{  
  71.     Map<String, Object> body = getErrorAttributes(request,  
  72.             isIncludeStackTrace(request, MediaType.TEXT\_HTML));  
  73.     HttpStatus status = getStatus(request);  
  74.     return new ResponseEntity<Map<String, Object>>(body, status);  
  75. \}  
  78. /\*\*  
  79.  \* Determine if the stacktrace attribute should be included.  
  80.  \* @param request the source request  
  81.  \* @param produces the media type produced (or \{@code MediaType.ALL\})  
  82.  \* @return if the stacktrace attribute should be included  
  83.  \*/  
  84. protected boolean isIncludeStackTrace(HttpServletRequest request,  
  85.                                       MediaType produces) \{  
  86.     ErrorProperties.IncludeStacktrace include = this.serverProperties.getError().getIncludeStacktrace();  
  87.     if (include == ErrorProperties.IncludeStacktrace.ALWAYS) \{  
  88.         return true;  
  89.     \}  
  90.     if (include == ErrorProperties.IncludeStacktrace.ON\_TRACE\_PARAM) \{  
  91.         return getTraceParameter(request);  
  92.     \}  
  93.     return false;  
  94. \}  
  97. /\*\*  
  98.  \* 获取错误的信息  
  99.  \* @param request  
  100.  \* @param includeStackTrace  
  101.  \* @return  
  102.  \*/  
  103. private Map<String, Object> getErrorAttributes(HttpServletRequest request,  
  104.                                                boolean includeStackTrace) \{  
  105.     RequestAttributes requestAttributes = new ServletRequestAttributes(request);  
  106.     return this.errorAttributes.getErrorAttributes(requestAttributes,  
  107.             includeStackTrace);  
  108. \}  
  110. /\*\*  
  111.  \* 是否包含trace  
  112.  \* @param request  
  113.  \* @return  
  114.  \*/  
  115. private boolean getTraceParameter(HttpServletRequest request) \{  
  116.     String parameter = request.getParameter("trace");  
  117.     if (parameter == null) \{  
  118.         return false;  
  119.     \}  
  120.     return !"false".equals(parameter.toLowerCase());  
  121. \}  
  123. /\*\*  
  124.  \* 获取错误编码  
  125.  \* @param request  
  126.  \* @return  
  127.  \*/  
  128. private HttpStatus getStatus(HttpServletRequest request) \{  
  129.     Integer statusCode = (Integer) request  
  130.             .getAttribute("javax.servlet.error.status\_code");  
  131.     if (statusCode == null) \{  
  132.         return HttpStatus.INTERNAL\_SERVER\_ERROR;  
  133.     \}  
  134.     try \{  
  135.         return HttpStatus.valueOf(statusCode);  
  136.     \}  
  137.     catch (Exception ex) \{  
  138.         return HttpStatus.INTERNAL\_SERVER\_ERROR;  
  139.     \}  
  140. \}  
  142. /\*\*  
  143.  \* 实现错误路径,暂时无用  
  144.  \* @see ExceptionMvcAutoConfiguration\#containerCustomizer()  
  145.  \* @return  
  146.  \*/  
  147. @Override  
  148. public String getErrorPath() \{  
  149.     return "";  
  150. \}

}
该示例写的也是非常简单明了的，但是结合本身项目的实际需求，也是不能直接拿来用的，需要做相应的改造，改造主要有以下方面：

1、因为项目是前后端分离的，所以Controller层不会有ModelAndView返回类型，需要返回自身的APIResponse返回类型

2、项目需要统计全部的异常，而不只是404或者500的异常

3、捕获到异常之后需要做特殊化的业务处理

所以基于以上几方面对示例代码做了改造，具体改造代码如下：

/**
* @Author: gmy
* @Description: Springboot全局异常统一处理
* @Date: 2018/5/30
* @Time: 16:41
*/
@RestController
@EnableConfigurationProperties({ServerProperties.class})
public class ExceptionController implements ErrorController { 

  1. private ErrorAttributes errorAttributes;  
  3. @Autowired  
  4. private ServerProperties serverProperties;  
  7. /\*\*  
  8.  \* 初始化ExceptionController  
  9.  \* @param errorAttributes  
  10.  \*/  
  11. @Autowired  
  12. public ExceptionController(ErrorAttributes errorAttributes) \{  
  13.     Assert.notNull(errorAttributes, "ErrorAttributes must not be null");  
  14.     this.errorAttributes = errorAttributes;  
  15. \}  
  18. @RequestMapping(value = "/error")   
  19. @ResponseBody  
  20. public APIResponse error(HttpServletRequest request) \{  
  21.     Map<String, Object> body = getErrorAttributes(request,  
  22.             isIncludeStackTrace(request, MediaType.ALL));  
  23.     HttpStatus status = getStatus(request);  
  24.     return new APIResponse(APIResponse.FAIL,null,body.get("message").toString());  
  25. \}  
  30. /\*\*  
  31.  \* Determine if the stacktrace attribute should be included.  
  32.  \* @param request the source request  
  33.  \* @param produces the media type produced (or \{@code MediaType.ALL\})  
  34.  \* @return if the stacktrace attribute should be included  
  35.  \*/  
  36. protected boolean isIncludeStackTrace(HttpServletRequest request,  
  37.                                       MediaType produces) \{  
  38.     ErrorProperties.IncludeStacktrace include = this.serverProperties.getError().getIncludeStacktrace();  
  39.     if (include == ErrorProperties.IncludeStacktrace.ALWAYS) \{  
  40.         return true;  
  41.     \}  
  42.     if (include == ErrorProperties.IncludeStacktrace.ON\_TRACE\_PARAM) \{  
  43.         return getTraceParameter(request);  
  44.     \}  
  45.     return false;  
  46. \}  
  49. /\*\*  
  50.  \* 获取错误的信息  
  51.  \* @param request  
  52.  \* @param includeStackTrace  
  53.  \* @return  
  54.  \*/  
  55. private Map<String, Object> getErrorAttributes(HttpServletRequest request,  
  56.                                                boolean includeStackTrace) \{  
  57.     RequestAttributes requestAttributes = new ServletRequestAttributes(request);  
  58.     return this.errorAttributes.getErrorAttributes(requestAttributes,  
  59.             includeStackTrace);  
  60. \}  
  62. /\*\*  
  63.  \* 是否包含trace  
  64.  \* @param request  
  65.  \* @return  
  66.  \*/  
  67. private boolean getTraceParameter(HttpServletRequest request) \{  
  68.     String parameter = request.getParameter("trace");  
  69.     if (parameter == null) \{  
  70.         return false;  
  71.     \}  
  72.     return !"false".equals(parameter.toLowerCase());  
  73. \}  
  75. /\*\*  
  76.  \* 获取错误编码  
  77.  \* @param request  
  78.  \* @return  
  79.  \*/  
  80. private HttpStatus getStatus(HttpServletRequest request) \{  
  81.     Integer statusCode = (Integer) request  
  82.             .getAttribute("javax.servlet.error.status\_code");  
  83.     if (statusCode == null) \{  
  84.         return HttpStatus.INTERNAL\_SERVER\_ERROR;  
  85.     \}  
  86.     try \{  
  87.         return HttpStatus.valueOf(statusCode);  
  88.     \}  
  89.     catch (Exception ex) \{  
  90.         return HttpStatus.INTERNAL\_SERVER\_ERROR;  
  91.     \}  
  92. \}  
  94. /\*\*  
  95.  \* 实现错误路径,暂时无用  
  96.  \* @return  
  97.  \*/  
  98. @Override  
  99. public String getErrorPath() \{  
  100.     return "";  
  101. \}

}
经过测试，可以捕获到所有层面上的异常，当前前提仍然是没有对异常进行catch处理，否则这里也是捕获不到

以上为网络上常用的两种全局异常统一处理方案，经过实际测试发现都可以实现满足要求。

其实基于AOP也可以实现异常的全局处理，自己相应的做了测试发现也满足要求，相应的代码如下：

/**
* @Author: gmy
* @Description: 基于AOP的全局异常统一处理
* @Date: 2018/6/1
* @Time: 13:46
*/
@Component
@Aspect
public class ExceptionAspectController {
public static final Logger logger = LoggerFactory.getLogger(ExceptionAspectController.class); 

  1. @Pointcut("execution(\* com.test.test.\*.\*(..))")//此处基于自身项目的路径做具体的设置  
  2. public void pointCut()\{\}  
  4. @Around("pointCut()")  
  5. public Object handleControllerMethod(ProceedingJoinPoint pjp) \{  
  6.     Stopwatch stopwatch = Stopwatch.createStarted();  
  8.     APIResponse<?> apiResponse;  
  9.     try \{  
  10.         logger.info("执行Controller开始: " + pjp.getSignature() + " 参数：" + Lists.newArrayList(pjp.getArgs()).toString());  
  11.         apiResponse = (APIResponse<?>) pjp.proceed(pjp.getArgs());  
  12.         logger.info("执行Controller结束: " + pjp.getSignature() + "， 返回值：" + apiResponse.toString());  
  13.         logger.info("耗时：" + stopwatch.stop().elapsed(TimeUnit.MILLISECONDS) + "(毫秒).");  
  14.     \} catch (Throwable throwable) \{  
  15.         apiResponse = handlerException(pjp, throwable);  
  16.     \}  
  18.     return apiResponse;  
  19. \}  
  21. private APIResponse<?> handlerException(ProceedingJoinPoint pjp, Throwable e) \{  
  22.     APIResponse<?> apiResponse = null;  
  23.     if(e.getClass().isAssignableFrom(MessageCenterException.class) )\{  
  24.         MessageCenterException messageCenterException = (MessageCenterException)e;  
  25.         logger.error("RuntimeException\{方法：" + pjp.getSignature() + "， 参数：" + pjp.getArgs() + ",异常：" + messageCenterException.getException().getMessage() + "\}", e);  
  26.         apiResponse = messageCenterException.getApiResponse();  
  27.     \} else if (e instanceof RuntimeException) \{  
  28.         logger.error("RuntimeException\{方法：" + pjp.getSignature() + "， 参数：" + pjp.getArgs() + ",异常：" + e.getMessage() + "\}", e);  
  29.         apiResponse = new APIResponse(APIResponse.FAIL,null,e.getMessage());  
  30.     \} else \{  
  31.         logger.error("异常\{方法：" + pjp.getSignature() + "， 参数：" + pjp.getArgs() + ",异常：" + e.getMessage() + "\}", e);  
  32.         apiResponse = new APIResponse(APIResponse.FAIL,null,e.getMessage());  
  33.     \}  
  35.     return apiResponse;  
  36. \}

}
经过测试，在执行切点中配置的路径中的方法有异常时，可以被这里捕获到。

以上是自己了解到并且亲自测试可行的全局异常统一处理方案，如果各位博友有什么问题或者有什么新的方案可以一块探讨下

2018/11/28最新编辑

经过一段时间的使用，现在项目里已经统一使用AOP方式来做全局异常统一处理了，选用AOP方式主要是因为AOP不只可以做全局异常统一处理还可以统一打印接口请求入参和返回结果日志，打印接口访问性能日志，处理sql注入攻击以及处理入参特殊字符等问题

下面贴出代码，供大家参考，也仅供参考

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.google.common.base.Stopwatch;
import com.google.common.collect.Lists;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.annotation.Resource;
import java.util.concurrent.TimeUnit;

/**
* @Author: gmy
* @Description: 调用接口打印性能日志以及接口报错之后记录错误日志
* @Date: 2018/9/20
* @Time: 15:16
*/
@Component
@Aspect
public class InterfaceRequestErrrorAndPerformanceLog { 

  1. public static final Logger logger = LoggerFactory.getLogger(InterfaceRequestErrrorAndPerformanceLog.class);  
  3. @Value("$\{dc.log.bad.value:3000\}")  
  4. private int performanceBadValue;  
  6. @Resource  
  7. private RabbitMQService rabbitMQService;  
  8. @Resource  
  9. private InterfaceErrorService interfaceErrorService;  
  11. @Pointcut("execution(\* test.test.test.test.test.controller.\*.\*.\*(..))")  
  12. public void pointCut()\{\}  
  14. @Around("pointCut()")  
  15. public APIResponse handleControllerMethod(ProceedingJoinPoint pjp) throws Throwable\{  
  16.     Stopwatch stopwatch = Stopwatch.createStarted();  
  18.     APIResponse apiResponse;  
  19.     try \{  
  20.         logger.info("执行Controller开始: " + pjp.getSignature() + " 参数：" + Lists.newArrayList(pjp.getArgs()).toString());  
  21.         //处理入参特殊字符和sql注入攻击  
  22.         checkRequestParam(pjp);  
  23.         //执行访问接口操作  
  24.         apiResponse = (APIResponse) pjp.proceed(pjp.getArgs());  
  25.         try\{  
  26.             logger.info("执行Controller结束: " + pjp.getSignature() + "， 返回值：" + JSONObject.toJSONString(apiResponse));  
  27.             //此处将日志打印放入try-catch是因为项目中有些对象实体bean过于复杂，导致序列化为json的时候报错，但是此处报错并不影响主要功能使用，只是返回结果日志没有打印，所以catch中也不做抛出异常处理  
  28.         \}catch (Exception ex)\{  
  29.             logger.error(pjp.getSignature()+" 接口记录返回结果失败！，原因为：\{\}",ex.getMessage());  
  30.         \}  
  31.         Long consumeTime = stopwatch.stop().elapsed(TimeUnit.MILLISECONDS);  
  32.         logger.info("耗时：" + consumeTime + "(毫秒).");  
  33.         //当接口请求时间大于3秒时，标记为异常调用时间，并记录入库  
  34.         if(consumeTime > performanceBadValue)\{  
  35.             DcPerformanceEntity dcPerformanceEntity = new DcPerformanceEntity();  
  36.             dcPerformanceEntity.setInterfaceName(pjp.getSignature().toString());  
  37.             dcPerformanceEntity.setRequestParam(Lists.newArrayList(pjp.getArgs()).toString());  
  38.             dcPerformanceEntity.setConsumeTime(consumeTime + "毫秒");  
  39.             RabbitMQMessageTarget mqTarget = RabbitMQMessageTarget.createFanoutTarget(ProjectConstants.DC\_KEY\_EXCHANGE\_PERFORMANCE, new String\[\] \{ ProjectConstants.DC\_KEY\_QUEUE\_PERFORMANCE\});  
  40.             rabbitMQService.send(mqTarget, JSON.toJSONString(dcPerformanceEntity));  
  41.         \}  
  42.     \} catch (Exception throwable) \{  
  43.         apiResponse = handlerException(pjp, throwable);  
  44.     \}  
  46.     return apiResponse;  
  47. \}  
  49. /\*\*  
  50.   \* @Author: gmy  
  51.   \* @Description: 处理接口调用异常  
  52.   \* @Date: 15:13 2018/10/25  
  53.   \*/  
  54. private APIResponse handlerException(ProceedingJoinPoint pjp, Throwable e) \{  
  55.     APIResponse apiResponse;  
  56.     if(e.getClass().isAssignableFrom(ProjectException.class) )\{  
  57.         //ProjectException为自定义异常类，项目中Controller层会把所有的异常都catch掉，并手工封装成ProjectException抛出来，这样做的目的是ProjectException会记录抛出异常接口的路径，名称以及请求参数等等，有助于错误排查  
  58.         ProjectException projectException = (ProjectException)e;  
  59.         logger.error("捕获到ProjectException异常:",JSONObject.toJSONString(projectException.getDcErrorEntity()));  
  60.         RabbitMQMessageTarget mqTarget = RabbitMQMessageTarget.createFanoutTarget(ProjectConstants.DC\_KEY\_EXCHANGE\_INTERFACE\_ERROR, new String\[\] \{ ProjectConstants.DC\_KEY\_QUEUE\_INTERFACE\_ERROR\});  
  61.         rabbitMQService.send(mqTarget, JSON.toJSONString(dataCenterException.getDcErrorEntity()));  
  62.         apiResponse = new APIResponse(APIResponse.FAIL,null,projectException.getDcErrorEntity().getErrorMessage());  
  63.     \} else if (e instanceof RuntimeException) \{  
  64.         logger.error("RuntimeException\{方法：" + pjp.getSignature() + "， 参数：" + pjp.getArgs() + ",异常：" + e.getMessage() + "\}", e);  
  65.         apiResponse = new APIResponse(APIResponse.FAIL,null,e.getMessage());  
  66.     \} else \{  
  67.         logger.error("异常\{方法：" + pjp.getSignature() + "， 参数：" + pjp.getArgs() + ",异常：" + e.getMessage() + "\}", e);  
  68.         apiResponse = new APIResponse(APIResponse.FAIL,null,e.getMessage());  
  69.     \}  
  71.     return apiResponse;  
  72. \}  
  74. /\*\*  
  75.   \* @Author: gmy  
  76.   \* @Description: 处理入参特殊字符和sql注入攻击  
  77.   \* @Date: 15:37 2018/10/25  
  78.   \*/  
  79. private void checkRequestParam(ProceedingJoinPoint pjp)\{  
  80.     String str = String.valueOf(pjp.getArgs());  
  81.     if (!IllegalStrFilterUtil.sqlStrFilter(str)) \{  
  82.         logger.info("访问接口：" + pjp.getSignature() + "，输入参数存在SQL注入风险！参数为：" + Lists.newArrayList(pjp.getArgs()).toString());  
  83.         DcErrorEntity dcErrorEntity = interfaceErrorService.processDcErrorEntity(pjp.getSignature() + "",Lists.newArrayList(pjp.getArgs()).toString(),"输入参数存在SQL注入风险!");  
  84.         throw new DataCenterException(dcErrorEntity);  
  85.     \}  
  86.     if (!IllegalStrFilterUtil.isIllegalStr(str)) \{  
  87.         logger.info("访问接口：" + pjp.getSignature() + ",输入参数含有非法字符!，参数为：" + Lists.newArrayList(pjp.getArgs()).toString());  
  88.         DcErrorEntity dcErrorEntity = interfaceErrorService.processDcErrorEntity(pjp.getSignature() + "",Lists.newArrayList(pjp.getArgs()).toString(),"输入参数含有非法字符!");  
  89.         throw new DataCenterException(dcErrorEntity);  
  90.     \}  
  91. \}

}

代码中使用了一些其他的工具类，比如IllegalStrFilterUtil等，我也把代码贴出来

import org.slf4j.LoggerFactory;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
* @Author: gmy
* @Description: 特殊字符检测工具（防止传入非法字符和sql注入攻击）
* @Date: 2018/10/25
* @Time: 15:08
*/
public class IllegalStrFilterUtil {
private static final org.slf4j.Logger Logger = LoggerFactory.getLogger(IllegalStrFilterUtil.class); 

  1. private static final String REGX = "!|！|@|◎|\#|＃|(\\\\$)|￥|%|％|(\\\\^)|……|(\\\\&)|※|(\\\\\*)|×|(\\\\()|（|(\\\\))|）|\_|——|(\\\\+)|＋|(\\\\|)|§ ";  
  3. /\*\*  
  4.  \* 对常见的sql注入攻击进行拦截  
  5.  \*  
  6.  \* @param sInput  
  7.  \* @return  
  8.  \*  true 表示参数不存在SQL注入风险  
  9.  \*  false 表示参数存在SQL注入风险  
  10.  \*/  
  11. public static Boolean sqlStrFilter(String sInput) \{  
  12.     if (sInput == null || sInput.trim().length() == 0) \{  
  13.         return false;  
  14.     \}  
  15.     sInput = sInput.toUpperCase();  
  17.     if (sInput.indexOf("DELETE") >= 0 || sInput.indexOf("ASCII") >= 0 || sInput.indexOf("UPDATE") >= 0 || sInput.indexOf("SELECT") >= 0  
  18.             || sInput.indexOf("'") >= 0 || sInput.indexOf("SUBSTR(") >= 0 || sInput.indexOf("COUNT(") >= 0 || sInput.indexOf(" OR ") >= 0  
  19.             || sInput.indexOf(" AND ") >= 0 || sInput.indexOf("DROP") >= 0 || sInput.indexOf("EXECUTE") >= 0 || sInput.indexOf("EXEC") >= 0  
  20.             || sInput.indexOf("TRUNCATE") >= 0 || sInput.indexOf("INTO") >= 0 || sInput.indexOf("DECLARE") >= 0 || sInput.indexOf("MASTER") >= 0) \{  
  21.         Logger.error("该参数怎么SQL注入风险：sInput=" + sInput);  
  22.         return false;  
  23.     \}  
  24.     Logger.info("通过sql检测");  
  25.     return true;  
  26. \}  
  28. /\*\*  
  29.  \* 对非法字符进行检测  
  30.  \*  
  31.  \* @param sInput  
  32.  \* @return  
  33.  \*  true 表示参数不包含非法字符  
  34.  \*  false 表示参数包含非法字符  
  35.  \*/  
  36. public static Boolean isIllegalStr(String sInput) \{  
  38.     if (sInput == null || sInput.trim().length() == 0) \{  
  39.         return false;  
  40.     \}  
  41.     sInput = sInput.trim();  
  42.     Pattern compile = Pattern.compile(REGX, Pattern.CASE\_INSENSITIVE);  
  43.     Matcher matcher = compile.matcher(sInput);  
  44.     Logger.info("通过字符串检测");  
  45.     return matcher.find();  
  46. \}

}
以上代码中涉及到真实项目信息的内容我都做了相应修改，代码仅供技术交流使用。
-——————————
作者：hao_kkkkk
来源：CSDN
原文：https://blog.csdn.net/hao\_kkkkk/article/details/80538955

发表评论

表情：
评论列表 （有 0 条评论，524人围观）

还没有评论，来说两句吧...

相关阅读

    相关 springboot 全局异常处理

    在实际项目中，我们经常会遇到关于异常处理的问题，异常是不能抛给用户看的，所以就要求我们给用户一个友好的提示或者在抛出异常之前捕获异常。有时异常中包含提示信息，所以我们只能在控制

    痛定思痛。痛定思痛。/ 0 赞/ 409 阅读

    相关 Springboot 全局异常处理

    最近在做项目时需要对异常进行全局统一处理，主要是一些分类入库以及记录日志等，因为项目是基于Springboot的，所以去网络上找了一些博客文档，然后再结合项目本身的一些特殊需求

    古城微笑少年丶古城微笑少年丶/ 0 赞/ 525 阅读