spring mvc 设置web资源不能直接访问

谁借莪１个温暖的怀抱￠ 2023-01-13 04:19 161阅读 0赞

### 1. application ###

配置资源位置：

server.web.resources.dir=mqmweb/src/main/webapp

### 2. 启动类 ###

资源加载,将资源放到目录菜单中。

public class Launcher { 
    
        private static final Logger LOG = Logger.getLogger(Launcher.class);
        public static WebAppServer webAppServer;
    
        public static void main(String[] args) throws Exception { 
            Thread.setDefaultUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() { 
                @Override
                public void uncaughtException(Thread t, Throwable e) { 
                    LOG.error(e.getMessage(), e);
                }
            });
    
            try { 
                LOG.info("...Now launch mqmid webserver...");
    
                /*LOG.info("step:init app authority"); RolePermission.init();*/
                LOG.info("step:init HadoopConfigManager init");
                HadoopConfigManager.getInstance().init();
    // ImpalaHelper.init();
                PrestoHelper.init();
    
                LOG.info("step:start jetty server");
                webAppServer = new WebAppServer();
                webAppServer.initService();
                webAppServer.startService();
            } catch (Exception e) { 
                LOG.error(e.getMessage(), e);
                System.exit(1);
            }
        }
    }
    
        public void initService() { 
            jettyEmbeddedServer = new Server(getThreadPool()) { 
                public void handle(HttpChannel connection) throws IOException, ServletException { 
                    Request request = connection.getRequest();
                    if ("/".equals(request.getRequestURI())) { 
                        Response response = connection.getResponse();
                        response.sendRedirect(webContext);
                        response.setStatus(Response.SC_OK);
                        response.closeOutput();
                    } else { 
                        super.handle(connection);
                    }
                }
            };
            this.jettyEmbeddedServer.setStopAtShutdown(true);
            this.bindAddress = SiteConfig.get("server.bind.http.host", "0.0.0.0");
            this.httpPort = SiteConfig.getInt("server.bind.http.port", 8111);
            this.jettyEmbeddedServer.addBean(new ScheduledExecutorScheduler("mqmid.webapp.shared.scheduler", true), true);
            this.jettyEmbeddedServer.addConnector(makeHttpConnector());
            this.jettyEmbeddedServer.setHandler(makeWebAppContext());
        }
        
        private WebAppContext makeWebAppContext() { 
            WebAppContext webAppContext = new WebAppContext();
            webAppContext.setContextPath(webContext);
            String webResourcesPath = System.getenv("WEB_RESOURCES_PATH");
            if (webResourcesPath == null) { 
                webResourcesPath = System.getProperty("WEB_RESOURCES_PATH");
                if (webResourcesPath == null) { 
                    webResourcesPath = SiteConfig.get("server.web.resources.dir", "mqmweb/src/main/webapp");
                }
            }
            File warFile = new File(webResourcesPath);
            if (!warFile.exists()) { 
                throw new RuntimeException(warFile.getAbsolutePath() + " is not found.");
            }
            this.warFileAbsolutePath = warFile.getAbsolutePath();
            webAppContext.setWar(warFile.getAbsolutePath());
            webAppContext.addAliasCheck(new AllowSymLinkAliasChecker());
            // This webapp will use jsps and jstl. We need to enable the
            // AnnotationConfiguration in order to correctly
            // set up the jsp container
            Configuration.ClassList classlist = Configuration.ClassList.setServerDefault(this.jettyEmbeddedServer);
            classlist.addBefore(
                    "org.eclipse.jetty.webapp.JettyWebXmlConfiguration",
                    "org.eclipse.jetty.annotations.AnnotationConfiguration");
    
            // Set the ContainerIncludeJarPattern so that jetty examines these
            // container-path jars for tlds, web-fragments etc.
            // If you omit the jar that contains the jstl .tlds, the jsp engine will
            // scan for them instead.
            webAppContext.setAttribute(
                    "org.eclipse.jetty.server.webapp.ContainerIncludeJarPattern",
                    ".*/[^/]*servlet-api-[^/]*\\.jar$|.*/javax.servlet.jsp.jstl-.*\\.jar$|.*/[^/]*taglibs.*\\.jar$");
            webAppContext.setParentLoaderPriority(true);
            return webAppContext;
        }

### 3. web.xml 配置 ###

有下面，三种情况。

#### 3.1 不开放静态资源 ####

<web-app>
        
    
    
    
    
    </web-app>

导致，直接使用静态资源的调用失败，无法获取到资源；

#### 3.2 指定扩展名匹配静态资源 ####

将上面配置替换为

<servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.jpg</url-pattern>
            </servlet-mapping>
            <servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.png</url-pattern>
            </servlet-mapping>
            <servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.gif</url-pattern>
            </servlet-mapping>
            <servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.ico</url-pattern>
            </servlet-mapping>
            <servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.js</url-pattern>
            </servlet-mapping>
            <servlet-mapping>
                <servlet-name>default</servlet-name>
                <url-pattern>*.css</url-pattern>
            </servlet-mapping>

这样，1. 不能够直接访问静态资源的目录，会报，找不到资源。  
2. 直接调用静态资源的接口也会访问不到资源  
3. 能够直接访问指定扩展名称的文件，有权限问题。

#### 3.3 开放静态资源，并给资源访问添加权限校验 ####

配置sevlert-mapping 后 浏览器可直接访问/view/下面的资源，需要添加权限校验才能够避免安全问题：  
直接的办法是给资源添加一个filter，进行权限过滤。

<servlet-mapping>
            <servlet-name>default</servlet-name>
            <url-pattern>/view/*</url-pattern>
        </servlet-mapping>
        <filter>
            <filter-name>securityFilter</filter-name>
            <filter-class>com.lenovo.mqm.web.SecurityFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>securityFilter</filter-name>
            <url-pattern>/view/*</url-pattern>
            <dispatcher>REQUEST</dispatcher>
            <dispatcher>FORWARD</dispatcher>
            <dispatcher>INCLUDE</dispatcher>
            <dispatcher>ERROR</dispatcher>
        </filter-mapping>

SecurityFilter

public class SecurityFilter implements Filter { 
        private static Logger logger = Logger.getLogger(SecurityFilter.class);
        private WebApplicationContext wac;
        private SessionService sessionService;
    
        private PermissionManager permissionManager;
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
                throws IOException, ServletException { 
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            HttpServletResponse httpResponse = (HttpServletResponse) response;
    
            Mqmid mqmid = sessionService.getLogined(httpRequest);
            if (null != mqmid && permissionManager.hasPermission(mqmid,httpRequest.getServletPath())){ 
                chain.doFilter(request, response);
            } else { 
                writePermissionDeny(httpResponse);
            }
        }
    
        private static void writePermissionDeny(HttpServletResponse httpResponse){ 
            String msg = "No right to access protected resources!";
            httpResponse.setStatus(401);
            ActionSupport.writeErrorResponse(httpResponse, msg);
        }
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException { 
            wac = WebApplicationContextUtils.getWebApplicationContext(filterConfig.getServletContext());
            assert wac != null;
    
            sessionService = wac.getBean("sessionServiceProxy", SessionService.class);
            assert sessionService != null;
    
            permissionManager = wac.getBean(PermissionManager.class);
            assert  permissionManager != null;
        }
    
        @Override
        public void destroy() { /* Do nothing */
        }
    }

参考：  
[参考一][Link 1]

[Link 1]: https://blog.csdn.net/LYY1448019681/article/details/109273481?utm_medium=distribute.pc_relevant.none-task-blog-2~default~BlogCommendFromMachineLearnPai2~default-2.control&dist_request_id=&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2~default~BlogCommendFromMachineLearnPai2~default-2.control