springmvc 部分加密通信

springmvc后台DES3 解密

数据

#1

#2

#3

在MIME格式的电子邮件中，base64可以用来将binary的字节序列数据编码成ASCII字符序列构成的文本。使用时，在传输编码方式中指定base64。然后，每次取出6个bit

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d/sk6VmuOd8c8WHspd3kba490j/3+Dez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn+MvkIJTGiwgPcdD8xEMEWgp6/s9gENhWGGnayBfWrSv/36pBNNVhb+HkKXlwPCAazIVbFK4CrohlviiJ3lJv7/qfFlPNPUAVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w==

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d%2Fsk6VmuOd8c8WHspd3kba490j%2F3%2BDez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn%2BMvkIJTGiwgPcdD8xEMEWgp6%2Fs9gENhWGGnayBfWrSv%2F36pBNNVhb%2BHkKXlwPCAazIVbFK4CrohlviiJ3lJv7%2FqfFlPNPUAVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w%3D%3D

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d/sk6VmuO
d8c8WHspd3kba490j/3+Dez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn+MvkIJTGiwgPcdD8xEM
EWgp6/s9gENhWGGnayBfWrSv/36pBNNVhb+HkKXlwPCAazIVbFK4CrohlviiJ3lJv7/qfFlPNPUA
VQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w==

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d%2fsk6VmuO%0ad8c8WHspd3kba490j%2f3%2bDez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn%2bMvkIJTGiwgPcdD8xEM%0aEWgp6%2fs9gENhWGGnayBfWrSv%2f36pBNNVhb%2bHkKXlwPCAazIVbFK4CrohlviiJ3lJv7%2fqfFlPNPUA%0aVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w%3d%3d

测试

@Controller
public class IndexController {

@RequestMapping("/")
@ResponseBody
Object index(String phone, String name, String password, String desc) {
System.out.println("-----------------------------------------");
System.out.println("phone:" + phone);
System.out.println("name:" + name);
System.out.println("password:" + password);
System.out.println("desc:" + desc);
return "Hello longdai!";
}
}

这里使用数据#3的URL编码后的数据

-----------------------------------------
phone:131212345678
name:karl
password:del555
desc:在MIME格式的电子邮件中，base64可以用来将binary的字节序列数据编码成ASCII字符序列构成的文本。使用时，在传输编码方式中指定base64。然后，每次取出6个bit

@Configuration
public class DecryptFilter extends OncePerRequestFilter {
private static Log log = LogFactory.getLog(DecryptFilter.class);

private static Pattern BASE64_PATTERN = Pattern.compile("^[a-zA-Z0-9\\+/]+[=]{0,2}$");
private static Pattern BASE64_PATTERN_RFC822 = Pattern.compile("^[a-zA-Z0-9\\+/\n]+[=]{0,2}$");

public String filter(HttpServletRequest request, String name, String input) {
String ret = input;
if (input == null || input.trim().equals("(null)")) {
return null;
}
boolean b1 = input.length()%4==0 && BASE64_PATTERN.matcher(input).matches();
boolean b2 = input.length() > 77 && input.charAt(76)=='\n' && BASE64_PATTERN_RFC822.matcher(input).matches();
if ( !b1 && !b2){
return injectSQLFilter(name, input);//not base64 text
}
try {
ret = Des3.decode(input);
} catch (Exception e) {
log.error(request.getRequestURI() + " error decode " + name + "=" + input, e);
}
return injectSQLFilter(name, ret);
}

public String injectSQLFilter(String name, String text){
if(text==null){
return null;
}
if(name.matches("password|passwd|loginPassword|dealPassword")){
return text;
}
//TODO 这里处理SQL注入，直接处理掉注入数据,或者下层拦截器处理
return text;
}

@Override
protected void doFilterInternal(final HttpServletRequest request,
HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {

chain.doFilter(new HttpServletRequestWrapper(request) {

protected Map<String, String[]> parameters = new HashMap<String, String[]>();
@Override
public String getParameter(String name) {
if (parameters.containsKey(name)){
String[] values = parameters.get(name);
if (values!=null && values.length>0){
return values[0];
}
}
String value = super.getParameter(name);
String retValue = filter(this, name, value);
parameters.put(retValue, new String[]{retValue});
return retValue;
}

@Override
public String[] getParameterValues(String name) {
if (parameters.containsKey(name)){
String[] values = parameters.get(name);
return values;
}
String[] values = super.getParameterValues(name);
if (values == null) {
return null;
}
for (int i = 0; i < values.length; i++) {
values[i] = filter(this, name, values[i]);
}
parameters.put(name, values);
return values;
}

}, response);

}
}