/**
 * Company Name : 中贸促信息技术有限责任公司	
 * Project Name:investWebsite
 * File Name:XssRequestWrapper2.java
 * Package Name:ccpit.base.utils
 * Date:2016年8月18日下午1:21:05
 * Copyright (c) 2016, liyang@ccpit.org All Rights Reserved.
 *
 */
package ccpit.base.utils;

import java.util.Iterator;
import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang.StringEscapeUtils;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.CleanResults;
import org.owasp.validator.html.Policy;
import org.owasp.validator.html.PolicyException;
import org.owasp.validator.html.ScanException;

/**
 * ClassName: XssRequestWrapper2 <br/>
 * Function: TODO ADD FUNCTION. <br/>
 * Reason: TODO ADD REASON(可选). <br/>
 * date: 2016年8月18日 下午1:21:05 <br/>
 *
 * @author liyang
 * @version 
 * @since JDK 1.6
 */
public class XssRequestWrapper2 extends HttpServletRequestWrapper{
	 private static Policy policy = null;  
	  static{  
	        //String path = URLUtility.getClassPath(XssRequestWrapper.class)+File.separator+"antisamy-anythinggoes-1.4.4.xml";  
	        String path =XssRequestWrapper2.class.getClassLoader().getResource("antisamy-anythinggoes-1.4.4.xml").getFile();  
	        System.out.println("policy_filepath:"+path);  
	        if(path.startsWith("file")){  
	            path = path.substring(6);  
	        }  
	         try {  
	            policy = Policy.getInstance(path);  
	        } catch (PolicyException e) {  
	            e.printStackTrace();  
	        }  
	    }  
	  
	    public XssRequestWrapper2(HttpServletRequest request) {  
	        super(request);  
	    }  
	      
	    @SuppressWarnings("rawtypes")  
	    public Map<String,String[]> getParameterMap(){  
	        Map<String,String[]> request_map = super.getParameterMap();  
	        Iterator iterator = request_map.entrySet().iterator();  
	        System.out.println("request_map"+request_map.size());  
	        while(iterator.hasNext()){  
	            Map.Entry me = (Map.Entry)iterator.next();  
	            //System.out.println(me.getKey()+":");  
	            String[] values = (String[])me.getValue();  
	            for(int i = 0 ; i < values.length ; i++){  
	                System.out.println(values[i]);  
	                values[i] = xssClean(values[i]);  
	            }  
	        }  
	        return request_map;  
	    }  
	     public String[] getParameterValues(String paramString)  
	      {  
	        String[] arrayOfString1 = super.getParameterValues(paramString);  
	        if (arrayOfString1 == null)  
	          return null;  
	        int i = arrayOfString1.length;  
	        String[] arrayOfString2 = new String[i];  
	        for (int j = 0; j < i; j++)  
	          arrayOfString2[j] = xssClean(arrayOfString1[j]);  
	        return arrayOfString2;  
	      }  
	  
	      public String getParameter(String paramString)  
	      {  
	        String str = super.getParameter(paramString);  
	        if (str == null)  
	          return null;  
	        return xssClean(str);  
	      }  
	  
	      public String getHeader(String paramString)  
	      {  
	        String str = super.getHeader(paramString);  
	        if (str == null)  
	          return null;  
	        return xssClean(str);  
	      }  
	        
	        
	    private String xssClean(String value) {  
	        AntiSamy antiSamy = new AntiSamy();  
	        try {  
	            //CleanResults cr = antiSamy.scan(dirtyInput, policyFilePath);   
	            final CleanResults cr = antiSamy.scan(value, policy);  
	            //安全的HTML输出  
	            String str =StringEscapeUtils.unescapeHtml(cr.getCleanHTML());
	            //解决“&nbsp;”转换成乱码;
	            str = str.replaceAll(antiSamy.scan("&nbsp",policy).getCleanHTML(),"");
	            System.out.println(str);
	            return str;  
	        } catch (ScanException e) {  
	            e.printStackTrace();  
	        } catch (PolicyException e) {  
	            e.printStackTrace();  
	        }  
	        return value;  
	    }  
}
