最近公司的项目在的安全检测，涉及到项目安全渗透等方面的问题；
参与项目的渗透等改造，是一个机遇与挑战，今后对与项目安全等方面会思考更多；
下面说说form表单对象提交，为了防止抓包，后台做的类型转化；一个简单的DEMO思路
1、数据库对象bean，属相与数据库中字段相同，有Integer，Boolean，Double等类型
2、form表单的对象formbean，所有属性都是String
3、将formbean的值赋值到bean对象，在赋值过程中对数据的安全性（类型转化的问题）进行判断，
form对象
package february.week1.safe;
/**
* Description: form表单的数据类型
* @Package february.week1.safe
* @author BIQI IS BEST
* @date 2018年2月5日 上午10:38:33
*/
public class PersonForm { private String name; private String sex; private String age; private String phoneNumber; private String salary; public PersonForm(String name, String sex, String age, String phoneNumber, String salary) {
super();
this.name = name;
this.sex = sex;
this.age = age;
this.phoneNumber = phoneNumber;
this.salary = salary;
} public PersonForm() {
super();
} public String getName() {
return name;
} public void setName(String name) {
this.name = name;
} public String getSex() {
return sex;
} public void setSex(String sex) {
this.sex = sex;
} public String getAge() {
return age;
} public void setAge(String age) {
this.age = age;
} public String getPhoneNumber() {
return phoneNumber;
} public void setPhoneNumber(String phoneNumber) {
this.phoneNumber = phoneNumber;
} public String getSalary() {
return salary;
} public void setSalary(String salary) {
this.salary = salary;
} @Override
public String toString() {
return "PersonForm [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber
+ ", salary=" + salary + "]";
} }
后台对象：
package february.week1.safe;
/**
* Description: 后台类型
* @Package february.week1.safe
* @author BIQI IS BEST
* @date 2018年2月5日 上午10:38:33
*/
public class Person { private String name; private String sex; private Integer age; private String phoneNumber; private Double salary; public Person() {
super();
} public Person(String name, String sex, Integer age, String phoneNumber, Double salary) {
super();
this.name = name;
this.sex = sex;
this.age = age;
this.phoneNumber = phoneNumber;
this.salary = salary;
} public String getName() {
return name;
} public void setName(String name) {
this.name = name;
} public String getSex() {
return sex;
} public void setSex(String sex) {
this.sex = sex;
} public Integer getAge() {
return age;
} public void setAge(Integer age) {
this.age = age;
} public String getPhoneNumber() {
return phoneNumber;
} public void setPhoneNumber(String phoneNumber) {
this.phoneNumber = phoneNumber;
} public Double getSalary() {
return salary;
} public void setSalary(Double salary) {
this.salary = salary;
} @Override
public String toString() {
return "Person [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber + ", salary="
+ salary + "]";
} }
测试的类：
package february.week1.safe;
/**
* Description: 转化字段的属性，并且捕获异常
* form表单提交时候，数据类型不一致的问题，防止渗透
* @Package february.week1.safe
* @author BIQI IS BEST
* @date 2018年2月5日 上午10:38:33
*/ import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map; public class ChangeFilterType { public static void main(String[] args) {
PersonForm personForm = new PersonForm();
personForm.setName("10");
personForm.setSalary("1212123");
personForm.setAge("qwe");
Person person2 = new Person();
changeFilter(personForm,person2);
} private static boolean changeFilter(Object objectForm,Object object2){
Map<String, String> map = getObjectFiled(objectForm);
try {
putValueToBean(map,object2);
} catch (Exception e) {
System.out.println(e.toString());
}
System.out.println(object2.toString());
return false;
} /**
* Description: 获得属性的map,以及属性的值
* @param bean
* @return
* @author BIQI 2018年2月5日 下午2:22:31
* @return TreeMap<String,String> @throws
*/
private static Map<String, String> getObjectFiled(Object bean){
Map<String, String> map = new HashMap<>(30);
Field[] fields = bean.getClass().getDeclaredFields();
for(Field field:fields){
// System.out.println(field.getName());
// System.out.println(field.getType().toString());
// System.out.println(getFieldValueByName(field.getName(),bean));
map.put(field.getName(), (String) getFieldValueByName(field.getName(),bean));
}
return map;
} /**
* Description: 属性的值
* @param fieldName
* @param bean
* @return
* @author BIQI 2018年2月5日 上午11:23:15
* @return Object @throws
*/
private static Object getFieldValueByName(String fieldName, Object bean) {
try {
String firstLetter = fieldName.substring(0, 1).toUpperCase();
String getter = "get" + firstLetter + fieldName.substring(1);
Method method = bean.getClass().getMethod(getter, new Class[] {});
Object value = method.invoke(bean, new Object[] {});
return value;
} catch (Exception e) {
return null;
}
} /**
* Description: 属性的转化 值的传入
* @param treeMap
* @param bean
* @author BIQI 2018年2月5日 上午11:55:52
* @return void @throws
* @throws Exception
*/
public static void putValueToBean(Map<String, String> treeMap,Object bean) throws Exception{ Field[] fields = bean.getClass().getDeclaredFields();
// 属性的长度判断
if (fields.length!= treeMap.size()) {
System.out.println("转换的对象不对");
throw new Exception("转换的对象不对");
} for(Field field:fields){
String fieldName = field.getName();
String fieldValue = treeMap.get(fieldName);
String firstLetter = fieldName.substring(0, 1).toUpperCase();
String setter = "set" + firstLetter + fieldName.substring(1); Method method = bean.getClass().getMethod(setter, field.getType());
String type = field.getType().toString();
try {
if ("class java.lang.String".equals(type)) {
method.invoke(bean,fieldValue);
}
if ("class java.lang.Integer".equals(type)) {
if (null == fieldValue || "".equals(fieldValue)) {
method.invoke(bean,0);
continue;
}
Integer temp = Integer.valueOf(fieldValue);
method.invoke(bean,temp);
}
if ("class java.lang.Double".equals(type)) {
if (null == fieldValue || "".equals(fieldValue)) {
method.invoke(bean,0);
continue;
}
Double temp = Double.valueOf(fieldValue);
method.invoke(bean,temp);
}
//其他的类型if(....){}
} catch (Exception e) {
throw new Exception("转换("+bean.getClass().getName()+")的属性："+fieldName+" 值"+fieldValue+" 出现问题");
}
}
} }