Servlet过滤器源码分析

系统管理员 2022-12-20 01:57 172阅读 0赞

## 1.概述 ##

Servlet过滤器是服务端和客户端请求与响应的中间层组件，可以进行过滤请求，处理完毕后再转给下一个资源。

在实际场景中，可能需要多个过滤器。即采用了过滤器链的方式来组织，如图所示。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTAwNjY5MzQ_size_16_color_FFFFFF_t_70_pic_center]

## 2. 源码相关 ##

先看几个主要的源码类

**Filter**

public interface Filter { 
    
        public void init(FilterConfig filterConfig) throws ServletException;
    
        public void doFilter(ServletRequest request, ServletResponse response,
                FilterChain chain) throws IOException, ServletException;
    
    
        public void destroy();
    
    }

**FilterChain（拦截器链）**

public interface FilterChain { 
        public void doFilter(ServletRequest request, ServletResponse response)
                throws IOException, ServletException;
    
    }

**ApplicationFilterConfig**

public final class ApplicationFilterConfig implements FilterConfig, Serializable { 
    }

本篇主要回答几个问题：

## 1）过滤器链元素如何添加？ ##

在ApplicationFilterChain类（FilterChain的实现类）中的addFilter()中，如下。

**ApplicationFilterChain**

/** * Filters. */
        private ApplicationFilterConfig[] filters = new ApplicationFilterConfig[0];
    
        
       void addFilter(ApplicationFilterConfig filterConfig) { 
    
            // Prevent the same filter being added multiple times
            for(ApplicationFilterConfig filter:filters)
                if(filter==filterConfig)
                    return;
    
            if (n == filters.length) { 
                ApplicationFilterConfig[] newFilters =
                    new ApplicationFilterConfig[n + INCREMENT];
                System.arraycopy(filters, 0, newFilters, 0, n);
                filters = newFilters;
            }
            filters[n++] = filterConfig;
    
        }

## 2）过滤器链如何依次执行？ ##

基本逻辑：  
当过滤器没有执行完时，依次执行过滤器。(pos<n)  
若执行完过滤器内容，则调用servlet.service()，放行。

final class ApplicationFilterChain implements FilterChain { 
    
      @Override
        public void doFilter(ServletRequest request, ServletResponse response)
            throws IOException, ServletException { 
    
            if( Globals.IS_SECURITY_ENABLED ) { 
                final ServletRequest req = request;
                final ServletResponse res = response;
                try { 
                    java.security.AccessController.doPrivileged(
                        new java.security.PrivilegedExceptionAction<Void>() { 
                            @Override
                            public Void run()
                                throws ServletException, IOException { 
                                internalDoFilter(req,res);
                                return null;
                            }
                        }
                    );
                } catch( PrivilegedActionException pe) { 
                    Exception e = pe.getException();
                    if (e instanceof ServletException)
                        throw (ServletException) e;
                    else if (e instanceof IOException)
                        throw (IOException) e;
                    else if (e instanceof RuntimeException)
                        throw (RuntimeException) e;
                    else
                        throw new ServletException(e.getMessage(), e);
                }
            } else { 
                internalDoFilter(request,response);
            }
        }
    
        private void internalDoFilter(ServletRequest request,
                                      ServletResponse response)
            throws IOException, ServletException { 
    
            // Call the next filter if there is one
            if (pos < n) { 
                ApplicationFilterConfig filterConfig = filters[pos++];
                try { 
                    Filter filter = filterConfig.getFilter();
    
                    if (request.isAsyncSupported() && "false".equalsIgnoreCase(
                            filterConfig.getFilterDef().getAsyncSupported())) { 
                        request.setAttribute(Globals.ASYNC_SUPPORTED_ATTR, Boolean.FALSE);
                    }
                    if( Globals.IS_SECURITY_ENABLED ) { 
                        final ServletRequest req = request;
                        final ServletResponse res = response;
                        Principal principal =
                            ((HttpServletRequest) req).getUserPrincipal();
    
                        Object[] args = new Object[]{ req, res, this};
                        SecurityUtil.doAsPrivilege ("doFilter", filter, classType, args, principal);
                    } else { 
                        filter.doFilter(request, response, this);
                    }
                } catch (IOException | ServletException | RuntimeException e) { 
                    throw e;
                } catch (Throwable e) { 
                    e = ExceptionUtils.unwrapInvocationTargetException(e);
                    ExceptionUtils.handleThrowable(e);
                    throw new ServletException(sm.getString("filterChain.filter"), e);
                }
                return;
            }
    
            // We fell off the end of the chain -- call the servlet instance
            try { 
                if (ApplicationDispatcher.WRAP_SAME_OBJECT) { 
                    lastServicedRequest.set(request);
                    lastServicedResponse.set(response);
                }
    
                if (request.isAsyncSupported() && !servletSupportsAsync) { 
                    request.setAttribute(Globals.ASYNC_SUPPORTED_ATTR,
                            Boolean.FALSE);
                }
                // Use potentially wrapped request from this point
                if ((request instanceof HttpServletRequest) &&
                        (response instanceof HttpServletResponse) &&
                        Globals.IS_SECURITY_ENABLED ) { 
                    final ServletRequest req = request;
                    final ServletResponse res = response;
                    Principal principal =
                        ((HttpServletRequest) req).getUserPrincipal();
                    Object[] args = new Object[]{ req, res};
                    SecurityUtil.doAsPrivilege("service",
                                               servlet,
                                               classTypeUsedInService,
                                               args,
                                               principal);
                } else { 
                    servlet.service(request, response);
                }
            } catch (IOException | ServletException | RuntimeException e) { 
                throw e;
            } catch (Throwable e) { 
                e = ExceptionUtils.unwrapInvocationTargetException(e);
                ExceptionUtils.handleThrowable(e);
                throw new ServletException(sm.getString("filterChain.servlet"), e);
            } finally { 
                if (ApplicationDispatcher.WRAP_SAME_OBJECT) { 
                    lastServicedRequest.set(null);
                    lastServicedResponse.set(null);
                }
            }
        }
    }

示例：  
两个过滤器FilterA、FilterB。  
a.两个过滤器都实现了Filter接口，通过addFilter()添加到拦截器链中。  
b.依次执行过滤器的doFilter()

从过滤器链中获取当前的过滤器  
ApplicationFilterConfig filterConfig = filters\[pos++\];  
’  
执行过滤器的doFilter() ，并将拦截器链作为参数传入，即此处的this。这里以FilterA为例。  
filter.doFilter(request, response, this);

FilterA方法执行完毕后，调用chain的doFilter。【函数回调】  
chain.doFilter(request,response);

再次回到拦截器链中，获取当前的过滤器。  
ApplicationFilterConfig filterConfig = filters\[pos++\];

拿到FilterB，循环以上步骤。

## 3) Tomcat与过滤器之间的调用？ ##

在第2点中说到了，FilterChain的doFilter()，那他是被谁调用的呢？这要说到过滤器是Servlet的，即Servlet容器。这里以Tomcat为例。

**StandardWrapperValue**

final class StandardWrapperValve extends ValveBase { 
             public final void invoke(Request request, Response response)
            throws IOException, ServletException { 
            ......
    
                // Create the filter chain for this request
            ApplicationFilterChain filterChain =
                    ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);
    
            // Call the filter chain for this request
            // NOTE: This also calls the servlet's service() method
            
                if ((servlet != null) && (filterChain != null)) { 
                    // Swallow output if needed
                    if (context.getSwallowOutput()) { 
                        try { 
                            SystemLogHandler.startCapture();
                            if (request.isAsyncDispatching()) { 
                                request.getAsyncContextInternal().doInternalDispatch();
                            } else { 
                                filterChain.doFilter(request.getRequest(),
                                        response.getResponse());
                            }
                        } finally { 
                            String log = SystemLogHandler.stopCapture();
                            if (log != null && log.length() > 0) { 
                                context.getLogger().info(log);
                            }
                        }
                    } else { 
                        if (request.isAsyncDispatching()) { 
                            request.getAsyncContextInternal().doInternalDispatch();
                        } else { 
                            filterChain.doFilter
                                (request.getRequest(), response.getResponse());
                        }
                    }
    
                }
                ......
            }
        }

tomcat的Container是如何处理请求的？  
通过**Pipeline-Value**管道。

依然是使用责任链模式，但是Pipeline-Valve使用的责任链模式和普通的责任链模式有些不同！区别主要有以下两点：

（1）每个Pipeline都有特定的Valve，而且是在管道的最后一个执行，这个Valve叫做BaseValve，BaseValve是不可删除的；

（2）在上层容器的管道的BaseValve中会调用下层容器的管道。

Container包含四个子容器，而这四个子容器对应的BaseValve分别在：StandardEngineValve、StandardHostValve、StandardContextValve、StandardWrapperValve。

当执行到StandardWrapperValve的时候，会在StandardWrapperValve中创建FilterChain，并调用其doFilter方法来处理请求，这个FilterChain包含着我们配置的与请求相匹配的Filter和Servlet，其doFilter方法会依次调用所有的Filter的doFilter方法和Servlet的service方法，这样请求就得到了处理！

## 3.小结 ##

在项目中，应用过滤器的地方会比较少，更多的是用拦截器。过滤器是Servlet容器中的，还未到HTTPServletRequest中。因此无法获取到请求的细节参数，相对拦截器来说，灵活性差一些。当然，这也是他的设计初衷决定的。在简单处理请求响应时候，过滤器完全可以胜任。

发现问题，质疑，找到答案。然后继续发现问题，解决问题。这是个很有意思的过程。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTAwNjY5MzQ_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/bddd265a570f4e668852cf3ab34fac61.png