Package org.apache.catalina.valves

Class RequestFilterValve

  • All Implemented Interfaces:
    Contained, Lifecycle, Valve, GlassFishValve
    Direct Known Subclasses:
    RemoteAddrValve, RemoteHostValve
    public abstract class RequestFilterValve
extends ValveBase
    Implementation of a Valve that performs filtering based on comparing the appropriate request property (selected based on which subclass you choose to configure into your Container's pipeline) against a set of regular expressions configured for this Valve.

    This valve is configured by setting the allow and/or deny properties to a comma-delimited list of regular expressions (in the syntax supported by the jakarta-regexp library) to which the appropriate request property will be compared. Evaluation proceeds as follows:

    • The subclass extracts the request property to be filtered, and calls the common process() method.
    • If there are any deny expressions configured, the property will be compared to each such expression. If a match is found, this request will be rejected with a "Forbidden" HTTP response.
    • If there are any allow expressions configured, the property will be compared to each such expression. If a match is found, this request will be allowed to pass through to the next Valve in the current pipeline.
    • If one or more deny expressions was specified but no allow expressions, allow this request to pass through (because none of the deny expressions matched it).
    • The request will be rejected with a "Forbidden" HTTP response.

    This Valve may be attached to any Container, depending on the granularity of the filtering you wish to perform.

    Version:
    $Revision: 1.5 $ $Date: 2006/03/07 22:30:07 $
    Author:
    Craig R. McClanahan

    • Field Detail

      • allow

        protected String allow
        The comma-delimited set of allow expressions.

      • allows

        protected Pattern[] allows
        The set of allow regular expressions we will evaluate.

      • denies

        protected Pattern[] denies
        The set of deny regular expressions we will evaluate.

      • deny

        protected String deny
        The comma-delimited set of deny expressions.

    • Constructor Detail

      • RequestFilterValve

        public RequestFilterValve()

    • Method Detail

      • getAllow

        public String getAllow()
        Return a comma-delimited set of the allow expressions configured for this Valve, if any; otherwise, return null.

      • setAllow

        public void setAllow​(String allow)
        Set the comma-delimited set of the allow expressions configured for this Valve, if any.
        Parameters:
        allow - The new set of allow expressions

      • getDeny

        public String getDeny()
        Return a comma-delimited set of the deny expressions configured for this Valve, if any; otherwise, return null.

      • setDeny

        public void setDeny​(String deny)
        Set the comma-delimited set of the deny expressions configured for this Valve, if any.
        Parameters:
        deny - The new set of deny expressions

      • invoke

        public abstract int invoke​(Request request,
                           Response response)
                    throws IOException,
                           jakarta.servlet.ServletException
        Extract the desired request property, and pass it (along with the specified request and response objects) to the protected process() method to perform the actual filtering. This method must be implemented by a concrete subclass.
        Specified by:
        invoke in interface GlassFishValve
        Specified by:
        invoke in class ValveBase
        Parameters:
        request - The servlet request to be processed
        response - The servlet response to be created
        Returns:
        INVOKE_NEXT or END_PIPELINE
        Throws:
        IOException - if an input/output error occurs
        jakarta.servlet.ServletException - if a servlet error occurs

      • precalculate

        protected Pattern[] precalculate​(String list)
        Return an array of regular expression objects initialized from the specified argument, which must be null or a comma-delimited list of regular expression patterns.
        Parameters:
        list - The comma-separated list of patterns
        Throws:
        IllegalArgumentException - if one of the patterns has invalid syntax

      • process

        protected int process​(String property,
                      Request request,
                      Response response)
               throws IOException,
                      jakarta.servlet.ServletException
        Perform the filtering that has been configured for this Valve, matching against the specified request property.
        Parameters:
        property - The request property on which to filter
        request - The servlet request to be processed
        response - The servlet response to be processed
        Throws:
        IOException - if an input/output error occurs
        jakarta.servlet.ServletException - if a servlet error occurs