Request body多次取得的问题

梦里梦外; 2022-05-09 03:14 173阅读 0赞

**简介：**  
HttpServletRequest中的取得body的方法有两种：getInputStream()、getReader()。  
但是这个两个方法只能用一次，取第二次的时候就会变为null，然而HttpServletRequest中的body二进制还是有的，感觉特别奇怪，原因可能是游标的变动，HttpServletRequest第一次取body时游标以跑到二进制流的尾部，然后第二次去的时候就取不到了，解决方法如下（已经处理中文乱码问题）：

**重写getInputStream方法**

import javax.servlet.ReadListener;
    import javax.servlet.ServletInputStream;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletRequestWrapper;
    import java.io.*;
    
    public class BodyReaderHttpServletRequestWrapper extends HttpServletRequestWrapper {
    
        private final String body;
    
        public BodyReaderHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
            super(request);
            StringBuffer stringBuilder = new StringBuffer();
            BufferedReader bufferedReader = null;
            try {
                InputStream inputStream = request.getInputStream();
                if (inputStream != null) {
                    bufferedReader = new BufferedReader(new InputStreamReader(inputStream,"utf-8"));
                    char[] charBuffer = new char[128];
                    int bytesRead = -1;
                    while ((bytesRead = bufferedReader.read(charBuffer)) > 0) {
                        stringBuilder.append(charBuffer, 0, bytesRead);
                    }
                } else {
                    stringBuilder.append("");
                }
            } catch (IOException ex) {
                throw ex;
            } finally {
                if (bufferedReader != null) {
                    try {
                        bufferedReader.close();
                    } catch (IOException ex) {
                        throw ex;
                    }
                }
            }
            body = stringBuilder.toString();
        }
    
        @Override
        public ServletInputStream getInputStream() throws IOException {
            final ByteArrayInputStream byteArrayInputStream =
             new ByteArrayInputStream(body.getBytes("utf-8"));
            return new ServletInputStream() {
                @Override
                public boolean isFinished() {
                    return false;
                }
    
                @Override
                public boolean isReady() {
                    return false;
                }
    
                @Override
                public void setReadListener(ReadListener readListener) {
    
                }
    
                @Override
                public int read() throws IOException {
                    return byteArrayInputStream.read();
                }
            };
        }
    
        @Override
        public BufferedReader getReader() throws IOException {
            return new BufferedReader(new InputStreamReader(this.getInputStream()));
        }
    
        public String getBody() {
            return this.body;
        }
    }

**拦截器：**

import javax.servlet.*;
    import javax.servlet.annotation.WebFilter;
    import javax.servlet.http.HttpServletRequest;
    import java.io.IOException;
    public class HttpServletRequestWrapperFilter implements Filter {
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
    
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
                throws IOException, ServletException {
    
            ServletRequest requestWrapper = null;
            if (request instanceof HttpServletRequest) {
                requestWrapper = new BodyReaderHttpServletRequestWrapper((HttpServletRequest) request);
            }
            if (null == requestWrapper) {
                chain.doFilter(request, response);
            } else {
                chain.doFilter(requestWrapper, response);
            }
    
        }
    
        @Override
        public void destroy() {
    
        }
    }

**补充:**  
HttpServletRequestWrapper 更好的写法

public class BodyReaderRequestWrapper extends HttpServletRequestWrapper {
        private static final Logger logger= LoggerFactory.getLogger(BodyReaderRequestWrapper.class);
        private byte[] body = new byte[0];
        /**
         * @param request 请求
         */
        public BodyReaderRequestWrapper(HttpServletRequest request) {
            super(request);
            try {
                ServletInputStream inputStream=request.getInputStream();
                if(null!=inputStream&&request.getContentLength()>0){
                    body=getRequestBody(inputStream);
                }
            } catch (IOException e) {
                logger.error("BodyReaderRequestWrapper read inputStream error={} ",e);
            }
        }
    
        private byte[] getRequestBody(InputStream inputStream){
            ByteArrayOutputStream byteArrayOutputStream=new ByteArrayOutputStream();
            try {
                IOUtils.copy(inputStream,byteArrayOutputStream);
                body=byteArrayOutputStream.toByteArray();
            } catch (IOException e) {
                logger.error("BodyReaderRequestWrapper get request body error",e);
            }finally {
                if (byteArrayOutputStream != null) {
                    try {
                        byteArrayOutputStream.close();
                    } catch (IOException e) {
                        logger.error("BodyReaderRequestWrapper get request body,close inputStream error",e);
                    }
                }
    
            }
            return body;
        }
    
        /**
         * 覆盖getParameter方法，将参数名和参数值都做xss过滤。
         * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
         * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
         */
        @Override
        public String getParameter(String name) {
            String value = super.getParameter(name);
            if (value != null) {
                value = Jsoup.clean(value,Whitelist.relaxed()).trim();
                //处理sql注入
                SQLFilterUtil.sqlInject(value);
            }
            return value;
        }
    
        /**
         * 重写处理xss攻击
         * @param name 参数名称
         * @return
         */
        @Override
        public String[] getParameterValues(String name) {
            String[] values = super.getParameterValues(name);
            if (values != null) {
                int length = values.length;
                String[] escapseValues = new String[length];
                for (int i = 0; i < length; i++) {
                    // 防xss攻击和过滤前后空格
                    escapseValues[i] = Jsoup.clean(values[i], Whitelist.relaxed()).trim();
                    //处理sql注入
                    SQLFilterUtil.sqlInject(escapseValues[i]);
                }
                return escapseValues;
            }
            return super.getParameterValues(name);
        }
    
        @Override
        public Map<String, String[]> getParameterMap() {
            Map<String, String[]> map = new LinkedHashMap<>();
            Map<String, String[]> parameters = super.getParameterMap();
            for (String key : parameters.keySet()) {
                String[] values = parameters.get(key);
                for (int i = 0; i < values.length; i++) {
                    // 防xss攻击和过滤前后空格
                    values[i] = Jsoup.clean(values[i], Whitelist.relaxed()).trim();
                    //处理sql注入 暂时去除
                    //SQLFilterUtil.sqlInject(values[i]);
                }
                map.put(key, values);
            }
            return map;
        }
    
        @Override
        public BufferedReader getReader() {
            return new BufferedReader(new InputStreamReader(getInputStream()));
        }
    
        @Override
        public ServletInputStream getInputStream() {
            final ByteArrayInputStream byteArrayInputStream=new ByteArrayInputStream(body);
            return new ServletInputStream() {
                @Override
                public boolean isFinished() {
                    return false;
                }
    
                @Override
                public boolean isReady() {
                    return false;
                }
    
                @Override
                public void setReadListener(ReadListener readListener) {
    
                }
    
                @Override
                public int read(){
                    return byteArrayInputStream.read();
                }
            };
        }
    }

**最近发现spring中已经有实现好的了,经过试验后发现其实不是的，不过这个类上的设计值得我们学习**  
ContentCachingRequestWrapper  
所以不要直接实现了，直接使用就好