Tomcat Filter之動態注入

時間 2020-07-12

標籤 tomcat filter 動態注入欄目 Tomcat 简体版

原文原文鏈接

前言

最近，看到好多不錯的關於「無文件Webshell」的文章，對其中利用上下文動態的注入Filter的技術作了一下簡單驗證，寫一下測試總結，不依賴任何框架，僅想學習一下tomcat的filter。html

先放幾篇大佬的文章：java

Filter介紹

詳細介紹略，簡單記錄一下個人理解：git

過濾器（Filter）：用來對指定的URL進行過濾處理，相似.net core裏的中間件，例如登陸驗證過濾器能夠用來限制資源的未受權訪問；
過濾鏈（FilterChain）：經過URL匹配動態將全部符合URL規則的過濾器共同組成一個過濾鏈，順序有前後，相似.net core的管道，不過區別在於過濾鏈是單向的，管道是雙向；

同Servlet，通常Filter的配置方式：github

web.xml
@WebFilter修飾

Filter註冊調用流程

新建一個登陸驗證的Filter: SessionFilter.javaweb

package com.reinject.MyFilter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.annotation.WebInitParam;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

/**
 *    判斷用戶是否登陸,未登陸則退出系統
 */
@WebFilter(filterName = "SessionFilter", urlPatterns = "/*",
        initParams = {@WebInitParam(name = "logonStrings", value = "index.jsp;addFilter.jsp"),
                @WebInitParam(name = "includeStrings", value = ".jsp"),
                @WebInitParam(name = "redirectPath", value = "/index.jsp"),
                @WebInitParam(name = "disabletestfilter", value = "N")})
public class SessionFilter implements Filter {

    public FilterConfig config;

    public void destroy() {
        this.config = null;
    }

    public static boolean isContains(String container, String[] regx) {
        boolean result = false;

        for (int i = 0; i < regx.length; i++) {
            if (container.indexOf(regx[i]) != -1) {
                return true;
            }
        }
        return result;
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest hrequest = (HttpServletRequest)request;
        HttpServletResponseWrapper wrapper = new HttpServletResponseWrapper((HttpServletResponse) response);

        String logonStrings = config.getInitParameter("logonStrings");        // 登陸登錄頁面
        String includeStrings = config.getInitParameter("includeStrings");    // 過濾資源後綴參數
        String redirectPath = hrequest.getContextPath() + config.getInitParameter("redirectPath");// 沒有登錄轉向頁面
        String disabletestfilter = config.getInitParameter("disabletestfilter");// 過濾器是否有效

        if (disabletestfilter.toUpperCase().equals("Y")) {    // 過濾無效
            chain.doFilter(request, response);
            return;
        }
        String[] logonList = logonStrings.split(";");
        String[] includeList = includeStrings.split(";");

        if (!this.isContains(hrequest.getRequestURI(), includeList)) {// 只對指定過濾參數後綴進行過濾
            chain.doFilter(request, response);
            return;
        }

        if (this.isContains(hrequest.getRequestURI(), logonList)) {// 對登陸頁面不進行過濾
            chain.doFilter(request, response);
            return;
        }

        String user = ( String ) hrequest.getSession().getAttribute("useronly");//判斷用戶是否登陸
        if (user == null) {
            wrapper.sendRedirect(redirectPath);
            return;
        }else {
            chain.doFilter(request, response);
            return;
        }
    }

    public void init(FilterConfig filterConfig) throws ServletException {
        config = filterConfig;
    }
}

觀察一個正常請求的函數棧：shell

_jspService:14, index_jsp (org.apache.jsp)
service:70, HttpJspBase (org.apache.jasper.runtime)
service:731, HttpServlet (javax.servlet.http)
service:439, JspServletWrapper (org.apache.jasper.servlet)
serviceJspFile:395, JspServlet (org.apache.jasper.servlet)
service:339, JspServlet (org.apache.jasper.servlet)
service:731, HttpServlet (javax.servlet.http)
internalDoFilter:303, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
doFilter:52, WsFilter (org.apache.tomcat.websocket.server)
internalDoFilter:241, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
doFilter:66, SessionFilter (com.reinject.MyFilter)
internalDoFilter:241, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
invoke:218, StandardWrapperValve (org.apache.catalina.core)
invoke:122, StandardContextValve (org.apache.catalina.core)
invoke:505, AuthenticatorBase (org.apache.catalina.authenticator)
invoke:169, StandardHostValve (org.apache.catalina.core)
invoke:103, ErrorReportValve (org.apache.catalina.valves)
invoke:956, AccessLogValve (org.apache.catalina.valves)
invoke:116, StandardEngineValve (org.apache.catalina.core)
service:442, CoyoteAdapter (org.apache.catalina.connector)
process:1082, AbstractHttp11Processor (org.apache.coyote.http11)
process:623, AbstractProtocol$AbstractConnectionHandler (org.apache.coyote)
run:316, JIoEndpoint$SocketProcessor (org.apache.tomcat.util.net)
runWorker:1149, ThreadPoolExecutor (java.util.concurrent)
run:624, ThreadPoolExecutor$Worker (java.util.concurrent)
run:61, TaskThread$WrappingRunnable (org.apache.tomcat.util.threads)
run:748, Thread (java.lang)

找到最開始的ApplicationFilterChain位置，調用者是StandardWrapperValve的invoke，再觀察invoke代碼不難看出是用ApplicationFilterFactory動態生成的ApplicationFilterChain：apache

// Create the filter chain for this request
ApplicationFilterFactory factory =
    ApplicationFilterFactory.getInstance();
ApplicationFilterChain filterChain =
    factory.createFilterChain(request, wrapper, servlet);

createFilterChain根據xml配置動態生成一個過濾鏈，部分代碼以下：數組

// Acquire the filter mappings for this Context
StandardContext context = (StandardContext) wrapper.getParent();
FilterMap filterMaps[] = context.findFilterMaps();

// If there are no filter mappings, we are done
if ((filterMaps == null) || (filterMaps.length == 0))
    return (filterChain);

// Acquire the information we will need to match filter mappings
String servletName = wrapper.getName();

// Add the relevant path-mapped filters to this filter chain
for (int i = 0; i < filterMaps.length; i++) {
    if (!matchDispatcher(filterMaps[i] ,dispatcher)) {
        continue;
    }
    if (!matchFiltersURL(filterMaps[i], requestPath))
        continue;
    ApplicationFilterConfig filterConfig = (ApplicationFilterConfig)
        context.findFilterConfig(filterMaps[i].getFilterName());
    if (filterConfig == null) {
        // FIXME - log configuration problem
        continue;
    }
    boolean isCometFilter = false;
    if (comet) {
        try {
            isCometFilter = filterConfig.getFilter() instanceof CometFilter;
        } catch (Exception e) {
            // Note: The try catch is there because getFilter has a lot of 
            // declared exceptions. However, the filter is allocated much
            // earlier
            Throwable t = ExceptionUtils.unwrapInvocationTargetException(e);
            ExceptionUtils.handleThrowable(t);
        }
        if (isCometFilter) {
            filterChain.addFilter(filterConfig);
        }
    } else {
        filterChain.addFilter(filterConfig);
    }
}

全部的filter能夠經過context.findFilterMaps()方法獲取，FilterMap結構以下：tomcat

FilterMap中存放了全部filter相關的信息包括filterName和urlPattern。安全

有了這些以後，使用matchFiltersURL函數將每一個filter和當前URL進行匹配，匹配成功的經過context.findFilterConfig獲取filterConfig，filterConfig結構以下：

以後將filterConfig添加到filterChain中，最後回到StandardWrapperValve中調用doFilter進入過濾階段。

這個圖（@寬字節安全）可以很清晰的看到整個filter流程：

經過上面的流程，可知全部的filter信息都是從context（StandardContext）獲取到的，因此假如能夠獲取到這個context就能夠經過反射的方式修改filterMap和filterConfig從而達到動態註冊filter的目的。

獲取context

打開jconsole，獲取tomcat的Mbean:

感受其中好多地方均可以獲取到context，好比RequestProcessor、Resource、ProtocolHandler、WebappClassLoader、Value。

Value獲取

代碼：

MBeanServer mBeanServer = Registry.getRegistry(null, null).getMBeanServer();
// 獲取mbsInterceptor
Field field = Class.forName("com.sun.jmx.mbeanserver.JmxMBeanServer").getDeclaredField("mbsInterceptor");
field.setAccessible(true);
Object mbsInterceptor = field.get(mBeanServer);
// 獲取repository
field = Class.forName("com.sun.jmx.interceptor.DefaultMBeanServerInterceptor").getDeclaredField("repository");
field.setAccessible(true);
Object repository = field.get(mbsInterceptor);
// 獲取domainTb
field = Class.forName("com.sun.jmx.mbeanserver.Repository").getDeclaredField("domainTb");
field.setAccessible(true);
HashMap<String, Map<String, NamedObject>> domainTb = (HashMap<String,Map<String,NamedObject>>)field.get(repository);
// 獲取domain
NamedObject nonLoginAuthenticator = domainTb.get("Catalina").get("context=/,host=localhost,name=NonLoginAuthenticator,type=Valve");
field = Class.forName("com.sun.jmx.mbeanserver.NamedObject").getDeclaredField("object");
field.setAccessible(true);
Object object = field.get(nonLoginAuthenticator);
// 獲取resource
field = Class.forName("org.apache.tomcat.util.modeler.BaseModelMBean").getDeclaredField("resource");
field.setAccessible(true);
Object resource = field.get(object);
// 獲取context
field = Class.forName("org.apache.catalina.authenticator.AuthenticatorBase").getDeclaredField("context");
field.setAccessible(true);
StandardContext standardContext = (StandardContext) field.get(resource);

反射弧：mBeanServer->mbsInterceptor->repository->domainTb->nonLoginAuthenticator->resource->context。

經過StandardContext註冊filter

經過filter流程分析可知，註冊filter須要兩步：

修改filterConfigs；
將filter插到filterMaps的0位置；

在此以前，先看一下咱們比較關心的context中三個成員變量：

filterConfigs：filterConfig的數組
filterRefs：filterRef的數組
filterMaps：filterMap的數組

filterConfig的結構以前看過，filterConfig.filterRef實際和context.filterRef指向的地址同樣：

Expression: ((StandardContext) context).filterConfigs.get("SessionFilter").filterDef == ((StandardContext) context).filterDefs.get("SessionFilter");

從StandardContext類的方法看，能夠調用StandardContext.addFilterDef()修改filterRefs，而後調用StandardContext.filterStart()函數會自動根據filterDefs從新生成filterConfigs：

filterConfigs.clear();
for (Entry<String, FilterDef> entry : filterDefs.entrySet()) {
    String name = entry.getKey();
    if (getLogger().isDebugEnabled())
        getLogger().debug(" Starting filter '" + name + "'");
    ApplicationFilterConfig filterConfig = null;
    try {
        filterConfig =
            new ApplicationFilterConfig(this, entry.getValue());
        filterConfigs.put(name, filterConfig);
    } catch (Throwable t) {
        t = ExceptionUtils.unwrapInvocationTargetException(t);
        ExceptionUtils.handleThrowable(t);
        getLogger().error
            (sm.getString("standardContext.filterStart", name), t);
        ok = false;
    }
}

綜上，修改filterRefs和filterConfigs的代碼以下：

// Gen filterDef
filterDef = new FilterDef();
filterDef.setFilterName(filterName);
filterDef.setFilterClass(filter.getClass().getName());
filterDef.setFilter(filter);
// Add filterDef
context.addFilterDef(filterDef);
// Refresh filterConfigs
context.filterStart();

改filterMaps就簡單了，添加上去改一下順序加到0位置：

// filterMap
filterMap.setFilterName(filterName);
filterMap.setDispatcher(String.valueOf(DispatcherType.REQUEST));
filterMap.addURLPattern(filterUrlPatern);
context.addFilterMap(filterMap);
// Order
Object[] filterMaps = context.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}

經過ApplicationContext註冊filter

屢次調試發現有多處context，上面一直用的都是StandardContext，觀察該結構發現還有一個私有變量context，類型爲ApplicationContext，經過他的定義發現其實就是一個ServletContext：

public class ApplicationContext implements ServletContext {
}

該結構中也有一些filter操做的方法：

public Map<String, ? extends FilterRegistration> getFilterRegistrations() {}
public FilterRegistration getFilterRegistration(String filterName) {}
public FilterRegistration.Dynamic addFilter(String filterName, Filter filter) {}

這三個函數返回值都是FilterRegistration，看一下結構：

public class ApplicationFilterRegistration implements FilterRegistration.Dynamic {
    public void addMappingForServletNames(EnumSet<DispatcherType> dispatcherTypes, boolean isMatchAfter, String... servletNames) {}
    public void addMappingForUrlPatterns(EnumSet<DispatcherType> dispatcherTypes, boolean isMatchAfter, String... urlPatterns) {}
    public Collection<String> getServletNameMappings() {}
    public Collection<String> getUrlPatternMappings() {}
    public String getClassName() {}
    public String getInitParameter(String name) {}
    public Map<String, String> getInitParameters() {}
    public String getName() {}
    public boolean setInitParameter(String name, String value) {}
    public Set<String> setInitParameters(Map<String, String> initParameters) {}
    public void setAsyncSupported(boolean asyncSupported) {}
}

很明顯打包了一些經常使用的註冊Filter的函數，因此可使用ApplicationContext和FilterRegistration進行註冊，測試代碼以下：

// Define
ApplicationContext applicationContext = new ApplicationContext(standardContext);
Filter filter = new TestApplicationContextAddFilter();
// Registe Filter
FilterRegistration.Dynamic filterRegistration = applicationContext.addFilter(filterName, filter);
// Create Map for urlPattern
filterRegistration.addMappingForUrlPatterns(EnumSet.of(javax.servlet.DispatcherType.REQUEST), false, new String[]{urlPatern});
// Order
Object[] filterMaps = standardContext.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}

很不幸，有IllegalStateException異常：

嚴重: Servlet.service() for servlet [HelloWorldServlet] in context with path [] threw exception [Servlet execution threw an exception] with root cause
java.lang.IllegalStateException: Filters can not be added to context  as the context has been initialised
	at org.apache.catalina.core.ApplicationContext.addFilter(ApplicationContext.java:1005)
	at org.apache.catalina.core.ApplicationContext.addFilter(ApplicationContext.java:970)
	at com.reinject.test.TestApplicationContextAddFilter.<clinit>(TestApplicationContextAddFilter.java:61)
	at com.reinject.MyServlet.HelloWorldServlet.doGet(HelloWorldServlet.java:50)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)

經過觀察AddFilter報錯的位置，發現是對standardContext的state校驗的時候不達標拋出的異常：

if (!context.getState().equals(LifecycleState.STARTING_PREP)) {
    //TODO Spec breaking enhancement to ignore this restriction
    throw new IllegalStateException(
            sm.getString("applicationContext.addFilter.ise",
                    getContextPath()));
}

那麼能夠先修改一下state爲LifecycleState.STARTING_PREP:

java.lang.reflect.Field stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTING_PREP);

再運行正常：

不過測試發現若是state不改回來，以後訪問全部頁面都會503：

綜上：

// Fix State
java.lang.reflect.Field stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTING_PREP);
// Define
ApplicationContext applicationContext = new ApplicationContext(standardContext);
Filter filter = new TestApplicationContextAddFilter();
// Registe Filter
FilterRegistration.Dynamic filterRegistration = applicationContext.addFilter(filterName, filter);
// Create Map for urlPattern
filterRegistration.addMappingForUrlPatterns(EnumSet.of(javax.servlet.DispatcherType.REQUEST), false, new String[]{urlPatern});
// Restore State
stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTED);
// Order
Object[] filterMaps = standardContext.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}