[JSP/SERVLET/SPRING] 웹프로젝트에 Filter 추가하기

Web 을 하다보면 XSS(Cross-Site Scripting) 공격등에 대비해서

보안이슈를 처리해야 하는데, 그중 많이 사용하는게 바로 필터

 

XSS 의 주원인이 바로 <script> 태그이기 때문.

SQL Injection 의 경우 대부분 일부 특수문자 예로 주석 --

 

Request 문자열중 시작태그를 &lt; &gt; 문자로 치환해주는 방법을 많이 사용합니다

바로 필터에서 말이죠

 

그 외에도 인코딩 이슈를 방지하기 위해

요청되는 문자열 인코딩을 지정해주기도 합니다

이건 뭐 10년전쯤 EUC-KR 많이 쓸때 발생하던거라 요즘도 있는진 모르겠지만..

Request.setCharset("UTF-8");

Response.setCharset("UTF-8");

맞나..

 

출처 :  https://stackoverflow.com/questions/11507477/spring-web-flow-how-is-a-request-handled

 

Spring life cycle 구조인데,  Request가 발생하면 제일 먼저 filter를 타는게 눈에 띄네요

 

그러니 사용자 요청(Client)에 따른 Parameter 출력기(?)를 만들기 위해 filter를 이용합니다

 

방법은 2가지로

1. 기존 (JSP/SERVLET) 방식으로 web.xml 에 필터를 추가하는 방법
2. Spring anotation 을 이용한 filter 추가 하는 방법

2번째는 spring에서 지원 하는거라 지원되는 버전을 확인해야 합니다

뭐 최신버전 쓴다면 신경안써도 되는문제

참고로, 전자정부프레임워크가 Spring 기반이라 사용가능

 

일단 사용자 필터를 만들고 등록해야되니, 심플하게 java 파일하나 만들어줍니다

---

• CustomFilter.java

package com;


import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class CustomFilter implements Filter {

  public void init(FilterConfig filterConfig) throws ServletException {
  }

  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
  throws IOException, ServletException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(); // 세션 받아옴.

    String url = request.getServletPath();
    try {
        System.out.println("## url: \t" + url);
    } catch (Exception e) {
        System.out.println("error : " + e);
    }

    chain.doFilter(req, res);
  }

  public void destroy() {
  }
}

Client 요청을 받으면 심플하게 호출페이지 url을 출력해주는 필터입니다

저 상태로는 동작을 안하니 web.xml에 필터 등록을 해줍니다

---

1 web.xml 을 이용한 필터 등록

<!-- web.xml에 추가 -->
<!-- filter 정의 -->
<filter>
  <filter-name>customFilter</filter-name>
  <filter-class>com.CustomFilter</filter-class>
</filter>

<!-- filter 매핑 -->
<filter-mapping>
  <filter-name>customFilter</filter-name>
  <!-- url-pattern>*</url-pattern --><!-- 모든 요청 -->
  <!-- url-pattern>*.action</url-pattern --><!-- *.action 요청 -->
  <url-pattern>*.do</url-pattern><!-- *.do 요청 -->
</filter-mapping>

url-pattern을 3개를 예로 넣어놓았는데, 실제로는 한개만 넣어야 합니다

 

web.xml을 열어서 중간에 추가하면 됩니다

주의할건 필터이름, class 경로가 맞는지 확인해야합니다

---

2. Spring Anotation 으로 추가

첫번째 방법은 web.xml 을 수정해줘야 하는 불편함이 있는데

요건 java 파일에 한줄만 추가 하면 됩니다

 

@WebFilter(urlPatterns= {"*.do"}, description="ParamFilter")

 

• CustomFilter.java

package com;


import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.annotation.WebFilter;

@WebFilter(urlPatterns= {"*.do"}, description="ParamFilter")
public class CustomFilter implements Filter {

  public void init(FilterConfig filterConfig) throws ServletException {
  }

  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
  throws IOException, ServletException {

    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(); // 세션 받아옴.

    String url = request.getServletPath();
    try {
        System.out.println("## url: \t" + url);
    } catch (Exception e) {
        System.out.println("error : " + e);
    }

    chain.doFilter(req, res);
  }

  public void destroy() {
  }
}

위에도 언급했지만 사용하는 스프링 버전에서 지원하는지 체크 필요

---

테스트를 해보면

• ##url  loginform.do
• ##url login.do
• ##url main.do

이런식으로 url 정보가 출력되는걸 확인할 수 있습니다

 

여기에 지난번에 Request parameter 출력을 붙이면

요청되는 url / parameter 정보를 출력해 줄테니 개발 속도가 좀더 올라가겠네요

 

예제 프로젝트는 귀찮으니 패스하는걸로...

 

* 참고로 Spring RequsetBody 로 넘어오는데이터는 이 방법으로 출력되지 않습니다.

관련글

[programing/JAVA&JSP&SERVLET&SPRING] - JAVA 자바 Map, HashMap, EgovMap 값 확인하기

[programing/JAVA&JSP&SERVLET&SPRING] - JAVA 자바 List, ArrayList, array 리스트, 배열 값 확인하기

[programing/JAVA&JSP&SERVLET&SPRING] - JAVA 자바 HttpServlet Request Param 확인