IDEA 导入 Tomcat9 源码

/*

 * Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

package trailers;

import java.io.IOException;

import java.io.PrintWriter;

import java.util.HashMap;

import java.util.Map;

import java.util.function.Supplier;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

/**

 * This example writes some trailer fields to the HTTP response.

 */

public class ResponseTrailers extends HttpServlet {

    private static final long serialVersionUID = 1L;

    private static final Supplier<Map<String,String>> TRAILER_FIELD_SUPPLIER =

            new TrailerFieldSupplier();

    @Override

    protected void doGet(HttpServletRequest req, HttpServletResponse resp)

            throws ServletException, IOException {

        resp.setTrailerFields(TRAILER_FIELD_SUPPLIER);

        resp.setContentType("text/plain");

        resp.setCharacterEncoding("UTF-8");

        PrintWriter pw  = resp.getWriter();

        pw.print("This response should include trailer fields.");

    }

    private static class TrailerFieldSupplier implements Supplier<Map<String,String>> {

        private static final Map<String,String> trailerFields = new HashMap<>();

        static {

            trailerFields.put("x-trailer-1", "Trailer value one");

            trailerFields.put("x-trailer-2", "Trailer value two");

        }

        @Override

        public Map<String, String> get() {

            return trailerFields;

        }

    }

}

/*

 * Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

package util;

import java.util.Locale;

import java.util.StringTokenizer;

/**

 * Processes a cookie header and attempts to obfuscate any cookie values that

 * represent session IDs from other web applications. Since session cookie names

 * are configurable, as are session ID lengths, this filter is not expected to

 * be 100% effective.

 *

 * It is required that the examples web application is removed in security

 * conscious environments as documented in the Security How-To. This filter is

 * intended to reduce the impact of failing to follow that advice. A failure by

 * this filter to obfuscate a session ID or similar value is not a security

 * vulnerability. In such instances the vulnerability is the failure to remove

 * the examples web application.

 */

public class CookieFilter {

    private static final String OBFUSCATED = "[obfuscated]";

    private CookieFilter() {

        // Hide default constructor

    }

    public static String filter(String cookieHeader, String sessionId) {

        StringBuilder sb = new StringBuilder(cookieHeader.length());

        // Cookie name value pairs are ';' separated.

        // Session IDs don't use ; in the value so don't worry about quoted

        // values that contain ;

        StringTokenizer st = new StringTokenizer(cookieHeader, ";");

        boolean first = true;

        while (st.hasMoreTokens()) {

            if (first) {

                first = false;

            } else {

                sb.append(';');

            }

            sb.append(filterNameValuePair(st.nextToken(), sessionId));

        }

        return sb.toString();

    }

    private static String filterNameValuePair(String input, String sessionId) {

        int i = input.indexOf('=');

        if (i == -1) {

            return input;

        }

        String name = input.substring(0, i);

        String value = input.substring(i + 1, input.length());

        return name + "=" + filter(name, value, sessionId);

    }

    public static String filter(String cookieName, String cookieValue, String sessionId) {

        if (cookieName.toLowerCase(Locale.ENGLISH).contains("jsessionid") &&

                (sessionId == null || !cookieValue.contains(sessionId))) {

            cookieValue = OBFUSCATED;

        }

        return cookieValue;

    }

}