jp.terasoluna.fw.web.thin
Class ExtensionFilter

java.lang.Object
  extended by jp.terasoluna.fw.web.thin.ExtensionFilter
All Implemented Interfaces:
javax.servlet.Filter

public class ExtensionFilter
extends java.lang.Object
implements javax.servlet.Filter

Performs extension check.

Returns the error SC_NOT_FOUND(404) for the access request to the path that contains the prohibited extension. It prohibits the direct access to the file.
At the time of performing the access control for prohibited extension, if there is special path that needs to be escaped from the extension check, it can be specified in the property file. Multiple paths that are out of the scope of extension check can be specified under a key in property file. This key uses numerical value starting from 1 to which "restrictionEscape" is attached as a prefix.
Extension which is to be prohibited from direct access should be specified with the key name, starting from 1, having the prefix as "access.control.prohibited.extension."

Property file configuration example

 # Specify the path which needs to be escaped from extension restriction check starting from 1. 
 restrictionEscape.1=/sample/logon/index.jsp
 restrictionEscape.2=/sample/error/error.jsp

 # Specify the extensions for which direct access control check needs to be performed starting from 1.
 access.control.prohibited.extension.1=.jsp
 access.control.prohibited.extension.2=.csv
 access.control.prohibited.extension.3=.pdf
 

How to use

To use this function, perform the following settings in deployment descriptor (web.xml).

 <filter>
   <filter-name>extensionFilter</filter-name>
   <filter-class>
     jp.terasoluna.fw.web.thin.ExtensionFilter
   </filter-class>
 </filter>

 <filter-mapping>
   <filter-name>extensionFilter</filter-name>
   <url-pattern>/*</url-pattern>
 </filter-mapping>
 


Field Summary
static java.lang.String EXTENSION_THRU_KEY
          Key of "request" attribute which indicates that the request has passed through the filter.
private static org.apache.commons.logging.Log log
          Log class.
private static java.lang.String PROHIBITED_EXTENSION_PREFIX
           Prefix attached to the key of extension which is fetched from ApplicationResource and which prohibits the direct access.
private static java.util.List<java.lang.String> prohibitedExtensionList
          List of extension that prohibits the direct access from Web browser.
static java.lang.String RESTRICTION_ESCAPE_PREFIX
          Prefix which is attached to the key of the path which is fetched from ApplicationResource and which is escaped from the extension restriction check.
private static java.util.List<java.lang.String> restrictionEscapePaths
          List of paths which is out of scope of extension restriction check.
 
Constructor Summary
ExtensionFilter()
           
 
Method Summary
 void destroy()
          It is called at the time of filter processing.
Processing is not performed in this class.
 void doFilter(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, javax.servlet.FilterChain chain)
          Performs extension check.
 void init(javax.servlet.FilterConfig config)
          This method is called when the filter changes to Service start state. After creating an instance of the filter, container calls init method only once.
In order to request the filter to execute the filter process, init method should finish normally. Container cannot change the Filter to service state when the init method is any of the following.
ServletException is thrown or It does not get recovered within the time defined by container.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

EXTENSION_THRU_KEY

public static final java.lang.String EXTENSION_THRU_KEY
Key of "request" attribute which indicates that the request has passed through the filter.

See Also:
Constant Field Values

RESTRICTION_ESCAPE_PREFIX

public static final java.lang.String RESTRICTION_ESCAPE_PREFIX
Prefix which is attached to the key of the path. This path is fetched from ApplicationResource and it escapes from the extension restriction check.

See Also:
Constant Field Values

log

private static org.apache.commons.logging.Log log
Log class.


PROHIBITED_EXTENSION_PREFIX

private static final java.lang.String PROHIBITED_EXTENSION_PREFIX
Prefix attached to the key of extension . This extension is fetched from ApplicationResource and it prohibits the direct access.

See Also:
Constant Field Values

prohibitedExtensionList

private static java.util.List<java.lang.String> prohibitedExtensionList
List of extension that prohibits the direct access from Web browser.


restrictionEscapePaths

private static java.util.List<java.lang.String> restrictionEscapePaths
List of path which escapes from extension restriction check.

Constructor Detail

ExtensionFilter

public ExtensionFilter()
Method Detail

init

public void init(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException
This method is called by the container when the filter changes to Service start state. After creating an instance of the filter, container calls init method only once.
In order to request the filter to execute the filter process, init method should finish normally. Container cannot change the Filter to service state when the init method is any of the following.

Specified by:
init in interface javax.servlet.Filter
Parameters:
config - FilterConfig instance.
Throws:
javax.servlet.ServletException - Exception which is thrown at the time of abnormal initialization.
See Also:
Filter.init(javax.servlet.FilterConfig)

doFilter

public void doFilter(javax.servlet.ServletRequest req,
                     javax.servlet.ServletResponse res,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException
Performs extension check.

Specified by:
doFilter in interface javax.servlet.Filter
Parameters:
req - HTTP request
res - HTTP response
chain - Filter chain
Throws:
java.io.IOException - I/O error
javax.servlet.ServletException - Servlet exception
See Also:
Filter.doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)

destroy

public void destroy()
It is called at the time of filter processing.
Processing is not performed in this class.

Specified by:
destroy in interface javax.servlet.Filter
See Also:
Filter.destroy()