package app.hongs.serv.common;

import app.hongs.Core;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * 跨站攻击拦截
 * @author Hongs
 */
public class XsrfFilter implements Filter {

    @Override
    public void init(FilterConfig fc) throws ServletException {
        // Nothing todo.
    }

    @Override
    public void doFilter(ServletRequest rxq, ServletResponse rxp, FilterChain fc) throws IOException, ServletException {
        HttpServletRequest  req = (HttpServletRequest ) rxq;
        HttpServletResponse rsp = (HttpServletResponse) rxp;
        String ref  = req.getHeader("Referer");
        String sche = req.getScheme( ) + "://";
        String host = req.getServerName();
        long   port = req.getServerPort();
        if (port != 80 && port != 443) {
            host += ":" + port;
        }
        if (null == ref || !ref.startsWith(sche + host + Core.BASE_HREF + "/")) {
            rsp.setStatus(HttpServletResponse.SC_FORBIDDEN);
            rsp.getWriter().print("XSRF Access Forbidden!");
            return;
        }
        fc.doFilter(req, rsp);
    }

    @Override
    public void destroy() {
        // Nothing todo.
    }

}

@@ -36,49 +36,90 @@
 ort 
-app.hongs.Core;%0Aimport java.io.IOExceptio
+java.io.IOException;%0Aimport java.util.regex.Matcher;%0Aimport java.util.regex.Patter
 n;%0Ai
@@ -503,16 +503,100 @@
 lter %7B%0A%0A
+    private static final Pattern DMN_PAT = Pattern.compile(%22%5E(%5C%5Cw+:)?//(%5B%5E/:%5D+)%22);%0A%0A
     @Ove
@@ -953,16 +953,67 @@
 se) rxp;
+%0A%0A        // %E5%A6%82%E6%9E%9C%E6%9C%89 X-Requested-With %E8%A1%A8%E7%A4%BA%E8%AF%B7%E6%B1%82%E6%9D%A5%E8%87%AA AJAX %E6%88%96 APP
 %0A       
@@ -1022,18 +1022,17 @@
 tring re
-f 
+t
  = req.g
@@ -1045,66 +1045,185 @@
 er(%22
-Referer%22);%0A        String sche = req.getScheme( ) + %22://%22;
+X-Requested-With%22 );%0A        if (ret != null && ret.length() != 0) %7B%0A            fc.doFilter(rxq, rxp);%0A            return;%0A        %7D%0A%0A        // %E6%8F%90%E5%8F%96%E5%88%B0 Referer %E5%B9%B6%E4%B8%8E%E5%BD%93%E5%89%8D%E8%AF%B7%E6%B1%82%E7%9A%84 URL %E6%AF%94%E5%AF%B9%E6%9D%A5%E5%88%A4%E6%96%AD%E5%90%8C%E5%9F%9F
 %0A   
@@ -1234,20 +1234,19 @@
  String 
-host
+ref
  = req.g
@@ -1251,144 +1251,212 @@
 .get
-ServerName();%0A        long   port = req.getServerPort();%0A        if (port != 80 && port != 443) %7B%0A            host += %22:%22 + port
+Header(%22Referer%22);%0A        String dmn = req.getServerName( );%0A        Matcher ma = DMN_PAT.matcher(ref);%0A        if (ma.find( ) && ! ma.group( 2 ).equals(dmn) ) %7B%0A            fc.doFilter(rxq, rxp)
 ;%0A      
   %7D%0A
@@ -1455,98 +1455,33 @@
     
-  %7D%0A
       
-  if (null == ref %7C%7C !ref.startsWith(sche + host + Core.BASE_HREF + %22/%22)) %7B%0A    
+return;%0A        %7D%0A%0A
     
@@ -1537,28 +1537,24 @@
 N);%0A        
-    
 rsp.getWrite
@@ -1594,69 +1594,8 @@
 %22);%0A
-            return;%0A        %7D%0A        fc.doFilter(req, rsp);%0A
     

优化 XSRF 过滤器, 排除 APP 请求