|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectjp.terasoluna.fw.web.thin.ExtensionFilter
public class ExtensionFilter
Performs extension check.
Returns the error SC_NOT_FOUND(404) for the access request to the path
that contains the prohibited extension. It prohibits the direct access
to the file.
At the time of performing the access control for prohibited extension,
if there is special path that needs to be escaped from the
extension check, it can be specified in the property file.
Multiple paths that are out of the scope of extension
check can be specified under a key in property file. This key uses
numerical value starting from 1 to which "restrictionEscape" is attached as a prefix.
Extension which is to be prohibited from direct access should be
specified with the key name, starting from 1, having the prefix as
"access.control.prohibited.extension."
# Specify the path which needs to be escaped from extension restriction check starting from 1.
restrictionEscape.1=/sample/logon/index.jsp
restrictionEscape.2=/sample/error/error.jsp
# Specify the extensions for which direct access control check needs to be performed starting from 1.
access.control.prohibited.extension.1=.jsp
access.control.prohibited.extension.2=.csv
access.control.prohibited.extension.3=.pdf
To use this function, perform the following settings in deployment descriptor (web.xml).
<filter>
<filter-name>extensionFilter</filter-name>
<filter-class>
jp.terasoluna.fw.web.thin.ExtensionFilter
</filter-class>
</filter>
<filter-mapping>
<filter-name>extensionFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Field Summary | |
---|---|
static java.lang.String |
EXTENSION_THRU_KEY
Key of "request" attribute which indicates that the request has passed through the filter. |
private static org.apache.commons.logging.Log |
log
Log class. |
private static java.lang.String |
PROHIBITED_EXTENSION_PREFIX
Prefix attached to the key of extension which is fetched from ApplicationResource and which prohibits the direct access. |
private static java.util.List<java.lang.String> |
prohibitedExtensionList
List of extension that prohibits the direct access from Web browser. |
static java.lang.String |
RESTRICTION_ESCAPE_PREFIX
Prefix which is attached to the key of the path which is fetched from ApplicationResource and which is escaped from the extension restriction check. |
private static java.util.List<java.lang.String> |
restrictionEscapePaths
List of paths which is out of scope of extension restriction check. |
Constructor Summary | |
---|---|
ExtensionFilter()
|
Method Summary | |
---|---|
void |
destroy()
It is called at the time of filter processing. Processing is not performed in this class. |
void |
doFilter(javax.servlet.ServletRequest req,
javax.servlet.ServletResponse res,
javax.servlet.FilterChain chain)
Performs extension check. |
void |
init(javax.servlet.FilterConfig config)
This method is called when the filter changes to Service start state. After creating an instance of the filter, container calls init method only once. In order to request the filter to execute the filter process, init method should finish normally. Container cannot change the Filter to service state when the init method is any of the following. ServletException is thrown or It does not get recovered within the time defined by container. |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
---|
public static final java.lang.String EXTENSION_THRU_KEY
public static final java.lang.String RESTRICTION_ESCAPE_PREFIX
private static org.apache.commons.logging.Log log
private static final java.lang.String PROHIBITED_EXTENSION_PREFIX
private static java.util.List<java.lang.String> prohibitedExtensionList
private static java.util.List<java.lang.String> restrictionEscapePaths
Constructor Detail |
---|
public ExtensionFilter()
Method Detail |
---|
public void init(javax.servlet.FilterConfig config) throws javax.servlet.ServletException
init
in interface javax.servlet.Filter
config
- FilterConfig instance.
javax.servlet.ServletException
- Exception which is thrown at the time of abnormal initialization.Filter.init(javax.servlet.FilterConfig)
public void doFilter(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, javax.servlet.FilterChain chain) throws java.io.IOException, javax.servlet.ServletException
doFilter
in interface javax.servlet.Filter
req
- HTTP requestres
- HTTP responsechain
- Filter chain
java.io.IOException
- I/O error
javax.servlet.ServletException
- Servlet exceptionFilter.doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
public void destroy()
destroy
in interface javax.servlet.Filter
Filter.destroy()
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |