package com.config;

import com.jfinal.aop.Interceptor;
import com.jfinal.aop.Invocation;
import com.jfinal.log.Log;

import javax.servlet.http.HttpServletRequest;
import java.util.HashMap;
import java.util.Map;

/**
 * @ClassName XssInterceptor
 * @Description
 * @Author zhangyanwei
 * @Date 2020/12/3 10:07
 * @Version 1.0
 **/
public class XssInterceptor implements Interceptor {
    public static Log logger = Log.getLog(LogInterceptor.class);

    public static final String[] strUrls = new String[] { "%2B", "%20", "%2F", "%3F", "%25", "%23", "%26", "%30", "%27",
            "%26", "%22", "%28", "%29", "%2a", "%2b", "%2d", "and"
    };

    /**
     * 过滤request的关键字
     */
    public static final String[] strSqls = new String[] {

            " or ", "exec ", "execute ", "insert ", "select ", "delete ", "update ", "alter", "create ", " count", "\\*",
            "chr", "asc", "mid", "master", "trunca"
            + "te ", "declare", "xp_cmdshell", "restore",
            "backup", "net +user", "net +localgroup +administrators", "netlocalgroup administrators","body.innerHtml","innerHtml",
            "like'", "table", "from", "grant", "column_name", "group_concat", "information_schema.columns",
            "table_schema", "union ", "where ", "order ", "join ", "modify",  "--", "into", "substr",
            "ascii","having","javascript","alert","script","function","location","document","window","onclick","href","->","write","setTimeout","setInterval","</"
            ,"referrer","<img","src","onerror","prompt","writeln","srcdoc","navigate","setTimeout","setInterval","execScript","URLUnencoded","expr","eval","\"\"\"*/","\f","\b","confir","input"
            ,"<",">","onfocus","onblur"

    };

    @Override
    public void intercept(Invocation invocation) {
        boolean flag = true;
        HttpServletRequest httpServletRequest = invocation.getController().getRequest();
        logger.info(httpServletRequest.getRemoteHost());
        Map<String, String[]> params = httpServletRequest.getParameterMap();
        for (String string : strSqls) {
            for (String key : params.keySet()) {
                for (String val : params.get(key)) {
                    if (string.equals(val) || val.indexOf(string) != -1 || val.contains(string)) {
                        flag = false;

                        /*invocation.getController().redirect("/503.html");
                        return;*/
                        //flag = false;
                        // 直接拦截
                        //invocation.getController().redirect("/503.html");
                        //flag = false;
                        //logger.info("xss攻击特殊拦截字符----->"+val+"String--->"+string);
                    }

                }
            }
        }
            if(flag){
                invocation.invoke();
            }else{
                Map result = new HashMap();
                result.put("code","333");
                result.put("msg","输入内容中包含非法字符！");
                invocation.getController().renderJson(result);
            }


    }
}
