AOP日志组件 多次获取post参数
- 需求：新增接口日志组件。通过拦截器对接口URL进行拦截处理，然后将接口post请求的参数与结果，写入日志表。
- 问题：POST方法的参数是存储在request.getInputStream中，只能读一次，不能多次读取。从中读取post请求参数，只能读取一次。在filter中获取之后，controller无法获取post请求参数。
- 解决办法：继承HttpServletRequest,先获取到请求参数，再加参数重新set到inputStream。
1.拦截器记录日志
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest)request;
String requestPath = httpRequest.getServletPath().split("\?")[0];
if(request == null){
chain.doFilter(request, response);
return ;
}
for (String noFilter : NO_FILETER_LIST) {
if(requestPath.toLowerCase().contains(noFilter)){
chain.doFilter(request, response);
return ;
}
}
Pattern pattern = Pattern.compile(".*[api|interface].*");
Matcher matcher = pattern.matcher(requestPath);
if(matcher.matches()){
LoggerManager loggerManager = SpringLoadListener.getBean("loggerManager",LoggerManager.class);
//扩展request，防止字符注入等
XssSqlHttpServletRequestWrapper xssRequest = new XssSqlHttpServletRequestWrapper((HttpServletRequest)request);
ResponseWrapper wrapResponse = new ResponseWrapper((HttpServletResponse)response);
//继续请求处理类
chain.doFilter(xssRequest, wrapResponse);
//获取URL的参数 get请求
Map<Object, Object> urlParam = xssRequest.getParameterMap();
//获取post参数
String param = xssRequest.getRequestParams();
JSONObject jObject = JSONObject.fromObject(urlParam);
jObject.put("postParam", param.toString());
String params = jObject.toString();
//获取接口处理类返回结果
byte[] data = wrapResponse.getResponseData();
String result = new String(data,"UTF-8");
//保存日志
loggerManager.operateInterfaceLogger("", params, requestPath, result);
ServletOutputStream out = response.getOutputStream();
out.write(data);
out.flush();
}else{
chain.doFilter(request, response);
}
}2.处理request请求，先获取inputStream,将请求参数复制给其他方法，同时再将获取的inputStream赋值回request中。
public class XssSqlHttpServletRequestWrapper extends HttpServletRequestWrapper
{
HttpServletRequest orgRequest = null;
private byte[] bytes;
private WrappedServletInputStream wrappedServletInputStream;
public XssSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
super(request);
this.orgRequest = request;
//读取输入流的请求参数，保存到bytes中
bytes = IOUtils.toByteArray(request.getInputStream());
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
this.wrappedServletInputStream = new WrappedServletInputStream(byteArrayInputStream);
//把post参数重新写入请求流
reWriteInputStream();
}
/**
* 把参数重新写进请求里
*/
public void reWriteInputStream() {
wrappedServletInputStream.setStream(new ByteArrayInputStream(bytes != null ? bytes : new byte[0]));
}
@Override
public ServletInputStream getInputStream() throws IOException {
return wrappedServletInputStream;
}
@Override
public BufferedReader getReader() throws IOException {
return new BufferedReader(new InputStreamReader(wrappedServletInputStream));
}
/**
* 获取post参数
*/
public String getRequestParams() throws IOException {
return new String(bytes, this.getCharacterEncoding());
}
//清洗参数，防止xss注入
public String[] getParameterValues(String parameter)
{
String[] values = super.getParameterValues(parameter);
if (values == null) {
return null;
}
int count = values.length;
String[] encodedValues = new String[count];
for (int i = 0; i < count; i++) {
encodedValues[i] = xssEncode(values[i]);
}
return encodedValues;
}
public String getParameter(String name)
{
String value = super.getParameter(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}
public String getHeader(String name)
{
String value = super.getHeader(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}
private static String xssEncode(String s)
{
return StringUtil.xssEncode(s);
}
public HttpServletRequest getOrgRequest()
{
return this.orgRequest;
}
public static HttpServletRequest getOrgRequest(HttpServletRequest req)
{
if ((req instanceof XssSqlHttpServletRequestWrapper)) {
return ((XssSqlHttpServletRequestWrapper)req).getOrgRequest();
}
return req;
}
private class WrappedServletInputStream extends ServletInputStream {
public void setStream(InputStream stream) {
this.stream = stream;
}
private InputStream stream;
public WrappedServletInputStream(InputStream stream) {
this.stream = stream;
}
public int read() throws IOException {
return stream.read();
}
public boolean isFinished() {
return true;
}
public boolean isReady() {
return true;
}
public void setReadListener(ReadListener readListener) {
}
}
}3.Manager保存日志记录。对LoggerAnnotation自定义注解，实现AOP日志保存。
@LoggerAnnotation(type="INTERFACE", name="#name", params="#params", desc="#pageLink")
public String operateInterfaceLogger(String name, String params, String pageLink, String result)
{
return result;
}
@Component
@Aspect
@Async
public class LoggerOperationAop
{
private static final Logger logger = LoggerFactory.getLogger(LoggerOperationAop.class);
@Autowired
private LoggerManager loggerManager;
@Autowired
private UserManager userManager;
@Autowired
private JdbcTemplateImpl jdbcTemplate;
public LoggerOperationAop() {}
@Pointcut("@annotation(LoggerAnnotation)")
private void serviceAspect(LoggerAnnotation LoggerAnnotation) {}
@Around("serviceAspect(LoggerAnnotation)")
public Object process(ProceedingJoinPoint point, LoggerAnnotation LoggerAnnotation)
throws Throwable
{
String targetName = point.getTarget().getClass().getName();
String methodName = point.getSignature().getName();
Object[] arguments = point.getArgs();
String operationType = LoggerAnnotation.type();
String message = LoggerAnnotation.desc();
String params = LoggerAnnotation.params();
String name = LoggerAnnotation.name();
String id = LoggerAnnotation.id();
String[] paramNames = ReflectParamNames.getNames(targetName, methodName);
if ((StringUtil.isNotBlank(name)) && (name.startsWith("#"))) {
String value = SpelParser.getKey(name, "", paramNames, arguments);
if (StringUtil.isNotBlank(value)) {
targetName = value;
}
}
String methodParams = "";
if ((StringUtil.isNotBlank(params)) && (params.startsWith("#"))) {
methodParams = SpelParser.getKey(params, "", paramNames, arguments);
}
if ((StringUtil.isNotBlank(message)) && (message.startsWith("#"))) {
String value = SpelParser.getKey(message, "", paramNames, arguments);
if (StringUtil.isNotBlank(value)) {
message = value;
}
}
String userId = null;
String userName = "游客";
try {
Subject currentSubject = SecurityUtils.getSubject();
if (currentSubject != null) {
Object tmpObj = currentSubject.getSession().getAttribute("authorizeUser");
if ((tmpObj != null) && ("INTERFACE".equals(operationType))) {
userName = StringUtil.parseAny2String(tmpObj);
} else if (currentSubject.getPrincipal() != null) {
ShiroDbRealm.ShiroUser shiroUser = (ShiroDbRealm.ShiroUser)currentSubject.getPrincipal();
userId = shiroUser.getUserId();
userName = shiroUser.getLoginName();
}
}
} catch (Exception e) {
logger.info("不支持shiro技术框架");
logger.error("异常信息:{}", e.getMessage());
}
Object target = point.proceed();
try
{
String extName = DateUtil.getYearMonth(new Date());
String sql = " INSERT INTO T_E4S_DB_LOG_MESSAGE_" + extName +
" (USER_ID,USER_NAME,CLASS_NAME,METHOD_NAME,METHOD_PARAMS,LOG_DATE,LOG_MESSAGE,OPERATION_TYPE,REMARK) " +
" VALUES(?,?,?,?,?,?,?,?,?) ";
Object[] object = { userId, userName, targetName, methodName, methodParams,
new Date(), message, operationType, target };
this.jdbcTemplate.beginTranstaion();
this.jdbcTemplate.update(sql, object);
this.jdbcTemplate.commit();
}
catch (Exception ex) {
logger.error("==异常通知异常==");
logger.error("异常信息:{}", ex.getMessage());
this.jdbcTemplate.rollback();
}
return target;
}
}
LoggerFilter里一个实现了XssSqlHttpServletRequestWrapper类，其构造器自动读取了servletRequest里的输入流，并把数据保存了下来，最后又把数据重新写入servletRequest里，在filter中可以读取post请求参数，cotroller也可以再次从request里读取到post请求参数。