|
@@ -0,0 +1,548 @@
|
|
|
+/*
|
|
|
+package com.ywt.gateway.utils;
|
|
|
+
|
|
|
+import com.alibaba.fastjson.JSON;
|
|
|
+import com.alibaba.fastjson.JSONArray;
|
|
|
+import com.alibaba.fastjson.JSONObject;
|
|
|
+import com.kayakwise.dcep.decorator.RecorderServerHttpRequestDecorator;
|
|
|
+import com.kayakwise.enums.ChannelCodeEnum;
|
|
|
+import com.kayakwise.enums.DcpActionEnum;
|
|
|
+import com.kayakwise.enums.MsgSNEnum;
|
|
|
+import com.kayakwise.extend.PlatformConstant;
|
|
|
+import com.kayakwise.frame.api.base.DcpsMesgHeadModel;
|
|
|
+import com.kayakwise.frame.util.DcpsMsgHeadUtils;
|
|
|
+import com.kayakwise.frame.util.JsonUtils;
|
|
|
+import com.kayakwise.frame.util.LogUtils;
|
|
|
+import com.kayakwise.models.entity.EntryRequest;
|
|
|
+import org.apache.commons.lang3.StringUtils;
|
|
|
+import org.apache.logging.log4j.ThreadContext;
|
|
|
+import org.slf4j.Logger;
|
|
|
+import org.slf4j.LoggerFactory;
|
|
|
+import org.springframework.core.io.buffer.DataBuffer;
|
|
|
+import org.springframework.http.HttpStatus;
|
|
|
+import org.springframework.http.server.reactive.ServerHttpRequest;
|
|
|
+import org.springframework.http.server.reactive.ServerHttpResponse;
|
|
|
+import org.springframework.web.server.ServerWebExchange;
|
|
|
+import reactor.core.publisher.Flux;
|
|
|
+import reactor.core.publisher.Mono;
|
|
|
+
|
|
|
+import java.nio.CharBuffer;
|
|
|
+import java.nio.charset.StandardCharsets;
|
|
|
+import java.util.*;
|
|
|
+import java.util.Map.Entry;
|
|
|
+import java.util.concurrent.atomic.AtomicReference;
|
|
|
+import java.util.regex.Matcher;
|
|
|
+import java.util.regex.Pattern;
|
|
|
+
|
|
|
+报文中转处理工具类
|
|
|
+public class ServletUtils {
|
|
|
+ private static final Logger log = LoggerFactory.getLogger(ServletUtils.class);
|
|
|
+
|
|
|
+ protected static final String CHARSET_UTF_8 = "UTF-8";
|
|
|
+ protected static final String CHARSET_GBK = "GBK";
|
|
|
+ private static final Pattern MSGCD_PATTERN = Pattern.compile("<msgCd>([^<]+)</msgCd>");
|
|
|
+
|
|
|
+ private static final Pattern ESB_SERVICE_CODE_PATTERN = Pattern.compile("<SERVICE_CODE>([^<]+)</SERVICE_CODE>");
|
|
|
+
|
|
|
+ private static final Pattern ESB_SERVICE_SCENE_PATTERN = Pattern.compile("<SERVICE_SCENE>([^<]+)</SERVICE_SCENE>");
|
|
|
+
|
|
|
+
|
|
|
+ private static final Pattern DCEP_MSGTP_PATTERN = Pattern
|
|
|
+ .compile("<head:MsgTp>([^<]+)</head:MsgTp>|<MsgTp>([^<]+)</MsgTp>");
|
|
|
+ private static final Pattern DCEP_MSGSN_PATTERN = Pattern
|
|
|
+ .compile("<head:MsgSN>([^<]+)</head:MsgSN>|<MsgSN>([^<]+)</MsgSN>");
|
|
|
+
|
|
|
+ private static final Pattern p = Pattern.compile("^[A-Za-z0-9_\\+/]+$");
|
|
|
+ private static final String badStr = "and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|"
|
|
|
+ + "char|declare|sitename|net user|xp_cmdshell|or|like|and|exec|create|"
|
|
|
+ + "table|from|grant|use|group_concat|column_name|"
|
|
|
+ + "information_schema.columns|table_schema|union|where|order|by";
|
|
|
+
|
|
|
+ private static List<Pattern> sqlKeyWords = new ArrayList<>();
|
|
|
+
|
|
|
+ static {
|
|
|
+ String keywords1[] = badStr.split("\\|");
|
|
|
+ for (String keywords : keywords1) {
|
|
|
+ sqlKeyWords.add(Pattern.compile(".*\\s" + keywords + "\\s.*"));
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ public Mono<Void> getEntryRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name, content;
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 从请求URL获取接口名
|
|
|
+ String path = request.getURI().getPath();
|
|
|
+ if (path.contains("wf")) {
|
|
|
+ name = path;
|
|
|
+ } else {
|
|
|
+ String[] action = path.split("/", -1);
|
|
|
+ name = action[action.length - 1];
|
|
|
+ }
|
|
|
+ log.info("请求接口:{}", name);
|
|
|
+ if (name == null) {
|
|
|
+ return sendError(exchange, HttpStatus.NOT_FOUND, "");
|
|
|
+ }
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ log.info("\n\n<----record begin: {}", content.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ String uuid = ThreadContext.get(PlatformConstant.LOG_UUID_KEY);
|
|
|
+ LogUtils.logPrintStart(LogUtils.LOG_TYPE_BEGIN, ChannelCodeEnum.SC99.getValue(), LogUtils.LOG_LOCAL_DCP, "",
|
|
|
+ uuid, uuid, name, DcpActionEnum.getName(name), content);
|
|
|
+ } catch (Throwable e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ entryRequest.setPrefix("");
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setActionNm(DcpActionEnum.getName(name));
|
|
|
+ entryRequest.setContent(content);
|
|
|
+ entryRequest.setContentType(contentType);
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ public Mono<Void> sendError(ServerWebExchange exchange, org.springframework.http.HttpStatus status, String message) {
|
|
|
+ ServerHttpResponse response = exchange.getResponse();
|
|
|
+ response.setStatusCode(status); // 设置响应码
|
|
|
+ message = message == null ? "" : message.trim();
|
|
|
+ DataBuffer wrap = response.bufferFactory().wrap(message.getBytes());
|
|
|
+ return response.writeWith(Mono.just(wrap));
|
|
|
+ }
|
|
|
+
|
|
|
+ public static String getBody(ServerHttpRequest request) {
|
|
|
+ AtomicReference<String> requestBody = new AtomicReference<>("");
|
|
|
+ RecorderServerHttpRequestDecorator requestDecorator = new RecorderServerHttpRequestDecorator(request);
|
|
|
+ Flux<DataBuffer> body = requestDecorator.getBody();
|
|
|
+ body.subscribe(buffer -> {
|
|
|
+ CharBuffer charBuffer = StandardCharsets.UTF_8.decode(buffer.asByteBuffer());
|
|
|
+ requestBody.set(charBuffer.toString());
|
|
|
+ });
|
|
|
+ return requestBody.get();
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ */
|
|
|
+/**
|
|
|
+ * 上游系统为xml报文
|
|
|
+ *//*
|
|
|
+
|
|
|
+ public Mono<Void> getEntryXmlMsgRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name, content;
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 从请求URL获取接口名
|
|
|
+ String path = request.getURI().getPath();
|
|
|
+ String[] action = path.split("/", -1);
|
|
|
+ name = action[3];
|
|
|
+ log.info("请求接口:{}", name);
|
|
|
+ if (name == null) {
|
|
|
+ return sendError(exchange, HttpStatus.NOT_FOUND, "");
|
|
|
+ }
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ log.debug("\n\n<----record begin: \r\n{}",
|
|
|
+ content.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ String sourceSystem = content.substring(content.indexOf("<esb:UserReferenceNo>") + 21,
|
|
|
+ content.indexOf("</esb:UserReferenceNo>"));
|
|
|
+ String logFlowRefNo = content.substring(content.indexOf("<esb:SystemReferenceNo>") + 23,
|
|
|
+ content.indexOf("</esb:SystemReferenceNo>"));
|
|
|
+ String logFlowReqNo = content.substring(content.indexOf("<esb:RequestSystemID>") + 21,
|
|
|
+ content.indexOf("</esb:RequestSystemID>"));
|
|
|
+ LogUtils.logPrintStart(LogUtils.LOG_TYPE_BEGIN, sourceSystem, LogUtils.LOG_LOCAL_DCP, "", logFlowRefNo,
|
|
|
+ logFlowReqNo, name, DcpActionEnum.getName(name), content);
|
|
|
+ } catch (Throwable e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ entryRequest.setActionNm(DcpActionEnum.getName(name));
|
|
|
+ entryRequest.setContent(content);
|
|
|
+ entryRequest.setContentType(contentType);
|
|
|
+
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ */
|
|
|
+/**
|
|
|
+ * 行里ESB请求进入
|
|
|
+ *//*
|
|
|
+
|
|
|
+ public Mono<Void> getEsbRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name, content;
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ //log.info("\n\n<----record begin: \r\n{}",
|
|
|
+ // content.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ content = content.replaceAll("\\\\r","").replaceAll("\\\\n","").replaceAll("\\\\t","");
|
|
|
+ content = content.replace("\\","");
|
|
|
+ Matcher m = ESB_SERVICE_CODE_PATTERN.matcher(content);
|
|
|
+ if (!m.find()) {
|
|
|
+ log.info("获取ESB服务编号失败,原始报文:{}", content);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ String serviceCode = m.group(1);
|
|
|
+ log.info("ESB服务编号:{}", serviceCode);
|
|
|
+ Matcher m1 = ESB_SERVICE_SCENE_PATTERN.matcher(content);
|
|
|
+ if (!m1.find()) {
|
|
|
+ log.info("获取报文编号失败,ESB服务编号报文格式错误:{}", content);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ String serviceScene = m1.group(1);
|
|
|
+ log.info("ESB服务场景编号:{}", serviceScene);
|
|
|
+ name = DcpActionEnum.getValueByServiceCodeAndScene(serviceCode+serviceScene);
|
|
|
+ log.info("请求接口:{}", name);
|
|
|
+ if (name == null) {
|
|
|
+ return sendError(exchange, HttpStatus.NOT_FOUND, "");
|
|
|
+ }
|
|
|
+ String sourceSystem = content.substring(content.indexOf("<CONSUMER_ID>") + 6,
|
|
|
+ content.indexOf("</CONSUMER_ID>"));
|
|
|
+ String logFlowReqNo = content.substring(content.indexOf("<CONSUMER_SEQ_NO>") + 22,
|
|
|
+ content.indexOf("</CONSUMER_SEQ_NO>"));
|
|
|
+ LogUtils.logPrintStart(LogUtils.LOG_TYPE_BEGIN, sourceSystem, LogUtils.LOG_LOCAL_DCP, "", "",
|
|
|
+ logFlowReqNo, name, DcpActionEnum.getName(name), content);
|
|
|
+ } catch (Throwable e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ String reqXml = content.substring(content.indexOf("<?xml"));
|
|
|
+ log.info("请求报文体:{}", reqXml.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ Map<String, String> map = new HashMap<>();
|
|
|
+ map.put("reqXml", reqXml);
|
|
|
+ entryRequest.setContent(JsonUtils.mapToJson(map));
|
|
|
+ entryRequest.setContentType("ESB");
|
|
|
+ entryRequest.setActionNm(DcpActionEnum.getName(name));
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setPrefix("");
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ */
|
|
|
+/**
|
|
|
+ * DCPS报文请求解析
|
|
|
+ * @param exchange
|
|
|
+ * @param contentType
|
|
|
+ * @param entryRequest
|
|
|
+ * @return
|
|
|
+ *//*
|
|
|
+
|
|
|
+ public Mono<Void> getDcpsRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name = "", content;
|
|
|
+ DcpsMesgHeadModel headModel = null;
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ log.debug("\n\n<----record begin: {}", content.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ // 从报文头中截取报文编号-接口名
|
|
|
+ if (content.indexOf("{H:") >= 0) {
|
|
|
+ String mesgHead = content.substring(content.indexOf("{H:"));
|
|
|
+ mesgHead = mesgHead.substring(0, mesgHead.indexOf("}") + 1);
|
|
|
+ String mesgType = mesgHead.length() >= 78 ? mesgHead.substring(58, 78).trim() : "";
|
|
|
+ log.info("请求报文编号:{}", mesgType);
|
|
|
+ if (mesgType == null || "".equals(mesgType)) {
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ name = mesgType.replace(".", "_");
|
|
|
+
|
|
|
+ // 解析报文头
|
|
|
+ headModel = new DcpsMesgHeadModel();
|
|
|
+ DcpsMsgHeadUtils.parseMsgHeader(mesgHead, headModel);
|
|
|
+ }
|
|
|
+
|
|
|
+ if (content.indexOf("{S:") >= 0) {
|
|
|
+ String signContent = content.substring(content.indexOf("{S:"));
|
|
|
+ signContent = signContent.substring(0, signContent.indexOf("}") + 1);
|
|
|
+ log.info("签名域:{}", signContent);
|
|
|
+ DcpsMsgHeadUtils.parseSignInfo(signContent, headModel);
|
|
|
+ }
|
|
|
+ String logFlowReqNo = content.substring(content.indexOf("<MsgId>") + 7, content.indexOf("</MsgId>"));
|
|
|
+ LogUtils.logPrintStart(LogUtils.LOG_TYPE_BEGIN, LogUtils.LOG_LOCAL_DCPS, LogUtils.LOG_LOCAL_DCP, "",
|
|
|
+ headModel.getMesgID(), logFlowReqNo, name, MsgSNEnum.getName(name), content);
|
|
|
+ } catch (Throwable e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ // 报文体
|
|
|
+ String reqXml = content.substring(content.indexOf("<?xml"));
|
|
|
+ log.info("请求报文体:{}", reqXml.replaceAll("[\\s&&[^\r\n]]*(?:[\r\n][\\s&&[^\r\n]]*)+", ""));
|
|
|
+ Map<String, String> map = new HashMap<>();
|
|
|
+ map.put("reqXml", reqXml);
|
|
|
+ map.put("reqHead", JsonUtils.objectToJson(headModel));
|
|
|
+
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setActionNm(DcpActionEnum.getName(name));
|
|
|
+ entryRequest.setPrefix("r_");
|
|
|
+ entryRequest.setContent(JsonUtils.mapToJson(map));
|
|
|
+ entryRequest.setContentType("application/json");
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ public Mono<Void> getDcepRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name = "", content, signature;
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ log.error("报文读取异常,请检查!");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ Matcher msgTPm = DCEP_MSGTP_PATTERN.matcher(content);
|
|
|
+ if (!msgTPm.find()) {
|
|
|
+ log.error("获取报文编号失败,请检查!");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ Matcher msgSnPm = DCEP_MSGSN_PATTERN.matcher(content);
|
|
|
+ if (!msgTPm.find()) {
|
|
|
+ log.error("获取报文编号失败,请检查!");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ String msgTp = msgTPm.group(1);
|
|
|
+ name = msgTp.toUpperCase().replace(".", "_");
|
|
|
+ String msgSn = msgSnPm.group(1);
|
|
|
+ signature = request.getHeaders().getFirst("Signature");
|
|
|
+ log.info("msgSn:{} xml:{} signature:{}", msgSn, content, signature);
|
|
|
+ // TODO 待完善数研所数据获取
|
|
|
+// String logFlowReqNo = content.substring(content.indexOf("<MsgId>") + 7, content.indexOf("</MsgId>"));
|
|
|
+// logPrintStart(LOG_TYPE_BEGIN, LOG_LOCAL_DCPS, LOG_LOCAL_DCP, "", headModel.getMesgID(), logFlowReqNo, "",
|
|
|
+//
|
|
|
+ } catch (Throwable e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ Map<String, String> map = new HashMap<>();
|
|
|
+ map.put("reqXml", content);
|
|
|
+ map.put("signature", signature);
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setPrefix("R_");
|
|
|
+ entryRequest.setContent(JsonUtils.mapToJson(map));
|
|
|
+ entryRequest.setContentType("application/json");
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ public Mono<Void> getNdpsRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+ String name = "", content;
|
|
|
+
|
|
|
+ try {
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+ // 读取请求报文
|
|
|
+ content = getBody(request);
|
|
|
+ if (content == null) {
|
|
|
+ log.info("未读取到请求报文");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ Matcher m = MSGCD_PATTERN.matcher(content);
|
|
|
+ if (!m.find()) {
|
|
|
+ log.info("获取报文编号失败,农信银报文格式错误:{}", content);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ String msgCd = m.group(1);
|
|
|
+ log.info("报文编号:{}", msgCd);
|
|
|
+ name = msgCd.toUpperCase().replace(".", "_");
|
|
|
+ // TODO 待完善农信数据获取
|
|
|
+// String logFlowReqNo = content.substring(content.indexOf("<MsgId>") + 7, content.indexOf("</MsgId>"));
|
|
|
+// logPrintStart(LOG_TYPE_BEGIN, LOG_LOCAL_DCPS, LOG_LOCAL_DCP, "", headModel.getMesgID(), logFlowReqNo, "",
|
|
|
+// name, "", "", "", "", content);
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ // 报文体
|
|
|
+ String reqXml = content.substring(content.indexOf("<?xml"));
|
|
|
+ log.info("请求报文体:{}", reqXml);
|
|
|
+ Map<String, String> map = new HashMap<>();
|
|
|
+ map.put("reqXml", reqXml);
|
|
|
+
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setPrefix("R_");
|
|
|
+ entryRequest.setContent(JsonUtils.mapToJson(map));
|
|
|
+ entryRequest.setContentType("application/json");
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ public Mono<Void> getUwapRequest(ServerWebExchange exchange, String contentType, EntryRequest entryRequest) {
|
|
|
+
|
|
|
+ String name = "", context;
|
|
|
+ ServerHttpRequest request = exchange.getRequest();
|
|
|
+
|
|
|
+ try {
|
|
|
+ // 读取请求报文
|
|
|
+ context = getBody(request);
|
|
|
+ if (context == null) {
|
|
|
+ log.info("未读取到请求报文");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.error("读取请求报文异常", e);
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ JSONObject requestObj = null;
|
|
|
+ JSONObject requestObjHeader = null;
|
|
|
+ JSONObject requestObjBody = null;
|
|
|
+ try {
|
|
|
+ requestObj = JSON.parseObject(context);
|
|
|
+ String msgHeader = requestObj.getString("msgHeader");
|
|
|
+ String msgBody = requestObj.getString("msgBody");
|
|
|
+ requestObjHeader = JSON.parseObject(msgHeader);
|
|
|
+ requestObjBody = JSON.parseObject(msgBody);
|
|
|
+ if (null == requestObj || null == requestObjHeader) {
|
|
|
+ log.error("报文解析失败,非法的JSON串,JSON无法解析!");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ // TODO 待完善Uwap数据获取
|
|
|
+// String logFlowReqNo = content.substring(content.indexOf("<MsgId>") + 7, content.indexOf("</MsgId>"));
|
|
|
+// logPrintStart(LOG_TYPE_BEGIN, LOG_LOCAL_DCPS, LOG_LOCAL_DCP, "", headModel.getMesgID(), logFlowReqNo, "",
|
|
|
+//
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.error("报文解析失败,非法的JSON串,JSON无法解析!");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ // 获取HEARD里的内容
|
|
|
+ String TOKEN = String.valueOf(request.getHeaders().get("TOKEN"));
|
|
|
+ String ORG = String.valueOf(request.getHeaders().get("ORG"));
|
|
|
+ String SERVICEID = String.valueOf(request.getHeaders().get("SERVICEID"));
|
|
|
+ String USERID = String.valueOf(request.getHeaders().get("USERID"));
|
|
|
+ String WIDTOKEN = String.valueOf(request.getHeaders().get("WIDTOKEN"));
|
|
|
+ try {
|
|
|
+// String msgType = requestObjHeader.getString("mesgType");// 交易码
|
|
|
+ name = SERVICEID.replace(".", "_");
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.info("获取报文编号失败");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+ Map<String, Object> reqMerge = mergeRequest(requestObjHeader, requestObjBody);
|
|
|
+ if (null == reqMerge) {
|
|
|
+ log.info("获取报文内容失败");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ reqMerge.put("TOKEN", TOKEN);
|
|
|
+ reqMerge.put("SERVICEID", SERVICEID);
|
|
|
+ reqMerge.put("USERID", USERID);
|
|
|
+ reqMerge.put("ORG", ORG);
|
|
|
+ reqMerge.put("WIDTOKEN", WIDTOKEN);
|
|
|
+
|
|
|
+ try {
|
|
|
+ log.info("SQL注入、Xss注入检查...");
|
|
|
+ proXSSAndSqlInject(JSON.parseObject(JsonUtils.mapToJson(reqMerge)));
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.error("非法请求内容");
|
|
|
+ return sendError(exchange, HttpStatus.BAD_REQUEST, "");
|
|
|
+ }
|
|
|
+
|
|
|
+ entryRequest.setContentType("application/json");
|
|
|
+ entryRequest.setAction(name);
|
|
|
+ entryRequest.setPrefix("r_");
|
|
|
+ entryRequest.setContent(JsonUtils.mapToJson(reqMerge));
|
|
|
+
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ */
|
|
|
+/**
|
|
|
+ * 合并到一个map中
|
|
|
+ *
|
|
|
+ * @param requestObjHeader
|
|
|
+ * @param requestObjBody
|
|
|
+ * @return
|
|
|
+ *//*
|
|
|
+
|
|
|
+ private static Map<String, Object> mergeRequest(JSONObject requestObjHeader, JSONObject requestObjBody) {
|
|
|
+ if (null == requestObjHeader) {
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+ Map<String, Object> msgHeader = JsonUtils.jsonToMap(requestObjHeader.toJSONString());
|
|
|
+
|
|
|
+ Map<String, Object> reqMerge = new HashMap<String, Object>();
|
|
|
+ for (String key : msgHeader.keySet()) {
|
|
|
+ reqMerge.put(key, msgHeader.get(key));
|
|
|
+ }
|
|
|
+ if (null != requestObjBody) {
|
|
|
+ Map<String, Object> msgBody = JsonUtils.jsonToMap(requestObjBody.toJSONString());
|
|
|
+ for (String key : msgBody.keySet()) {
|
|
|
+ reqMerge.put(key, msgBody.get(key));
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return reqMerge;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ private static void proXSSAndSqlInject(JSONObject jo) throws Exception {
|
|
|
+ proXSSAndSqlInject(null, null, jo);
|
|
|
+ }
|
|
|
+
|
|
|
+ private static void proXSSAndSqlInject(JSONObject jo, String key, Object value) throws Exception {
|
|
|
+ if (value instanceof JSONObject) {
|
|
|
+ JSONObject subJo = (JSONObject) value;
|
|
|
+ for (Entry<String, Object> entry : subJo.entrySet()) {
|
|
|
+ String subKey = entry.getKey();
|
|
|
+ Object subVal = entry.getValue();
|
|
|
+ proXSSAndSqlInject(subJo, subKey, subVal);
|
|
|
+ }
|
|
|
+ } else if (value instanceof JSONArray) {
|
|
|
+ for (Object subObj : (JSONArray) value) {
|
|
|
+ if (subObj instanceof JSONObject) {
|
|
|
+ proXSSAndSqlInject(null, null, (JSONObject) subObj);
|
|
|
+ }
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ cleanXSSAndSqlInject(jo, key, value);
|
|
|
+ }
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+ // 防XSS
|
|
|
+ private static void cleanXSSAndSqlInject(JSONObject json, String key, Object value) throws Exception {
|
|
|
+ json.replace(key, cleanXSSAndSqlInject(value));
|
|
|
+ }
|
|
|
+
|
|
|
+ // 防XSS
|
|
|
+ private static Object cleanXSSAndSqlInject(Object value) throws Exception {
|
|
|
+ if (value == null) {
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+ String val = String.valueOf(value);
|
|
|
+ if (StringUtils.isBlank(val)) {
|
|
|
+ return value;
|
|
|
+ }
|
|
|
+ if (p.matcher(val).matches()) {
|
|
|
+ return value;
|
|
|
+ }
|
|
|
+
|
|
|
+ for (Pattern sqlKey : sqlKeyWords) {
|
|
|
+ if (sqlKey.matcher(val).matches()) {
|
|
|
+ log.error("SQL注入检查不通过");
|
|
|
+ throw new Exception("报文非法!");
|
|
|
+ }
|
|
|
+ }
|
|
|
+ // 去掉javascript关键要素
|
|
|
+ return val.replaceAll("<", "<").replaceAll(">", ">").replaceAll("<", "& lt;").replaceAll(">", "& gt;")
|
|
|
+ .replaceAll("eval\\((.*)\\)", "").replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"")
|
|
|
+ .replaceAll("script", "");
|
|
|
+ }
|
|
|
+
|
|
|
+}
|
|
|
+*/
|