Recipe 7.9 Using a Filter to Read Parameter Values

Problem

You want to use a filter to intercept form input and read it.

Solution

Use the various getParameter methods of the ServletRequest API to take a look at parameter values in a filter.

Discussion

When you develop a filter for a servlet, your filter class has to implement the javax.servlet.Filter interface. This means that your Filter class has to implement the doFilter(request,response) and destroy( ) methods of that interface. The doFilter method contains the hook to the filtered servlet's parameter values. The doFilter's ServletRequest parameter has the getParameter, getParameterMap, getParameterNames, and getParameterValues methods which allow the filter to peek at a servlet's parameters and values.

First, you have to map the Filter you have designed to the servlet. This chunk of web.xml maps a Filter object to a servlet named Viewer.

<!-- any context-param elements go here -->
<filter>
        <filter-name>ParamSnoop</filter-name>
        <filter-class>com.jspservletcookbook.ParamSnoop</filter-class>
</filter>

<filter-mapping>
        <filter-name>ParamSnoop</filter-name>
        <servlet-name>Viewer</servlet-name>
</filter-mapping>
<!-- web.xml continues  -->

Place the filter class in the WEB-INF/classes directory of your web application, or inside a JAR file that is placed in WEB-INF/lib. The servlet container creates an instance when the container starts up of each filter that is declared in web.xml. The container then executes the filter (calls its doFilter method) when a user requests any of the servlets the filter is mapped to. So the ParamSnoop filter can inspect a request made to the Viewer servlet before the servlet processes the request.

"Only one instance per filter declaration in the deployment descriptor is instantiated per Java virtual machine of the container," according to the Servlet v2.4 specification, Chapter SRV.6.2.1.

Example 7-14 gets access to the parameters in the intercepted request by calling ServletRequest.getParameterMap( ) . However, you are free to use other ServletRequest API methods to look at parameters, such as getParameterStringName. The getParameterMap( ) method returns a java.util.Map of parameter names and values, which you extract from the Map using a java.util.Iterator and its next( ) method.

The call Map.entrySet( ) returns a java.util.Set, from which you obtain an Iterator by calling Set.iterator( ). The objects returned from the Iterator.next( ) method in this case are Map.Entry objects that hold key/value pairs, relating to the parameter names and values.

Example 7-14 also shows how to pull the key/value pairs out of the map and log the values using the ServletContext.log( ) method.

Example 7-14. Snooping on parameter values with a servlet

package com.jspservletcookbook;

import javax.servlet.*;
import javax.servlet.http.*;

import java.util.Map;
import java.util.Iterator;
import java.util.Map.Entry;

public class ParamSnoop implements Filter {
    
    private FilterConfig config;
    
    /** Creates new ParamSnoop */
    public ParamSnoop( ) {
    }
    
    public void  init(FilterConfig filterConfig)  throws ServletException{
    
        this.config = filterConfig;
    }
    
    public void  doFilter(
      ServletRequest request, ServletResponse response, FilterChain chain)
        throws java.io.IOException, ServletException {
 
          Map paramMap = request.getParameterMap( );
          ServletContext context = config.getServletContext( );

          /* use the ServletContext.log method to log 
          param names/values */
          context.log("doFilter called in: " + config.getFilterName( ) +  
          " on " + (new java.util.Date( )));

          context.log("Snooping the parameters in request: " + 
            ((HttpServletRequest) request).getRequestURI( ));
            
           Iterator iter = paramMap.entrySet( ).iterator( );
            while (iter.hasNext( )){
             
               Map.Entry me = (Map.Entry) iter.next( );
               context.log((String)me.getKey( ) + ": " +
                 ((String[]) me.getValue( ))[0]);
          }
         //continue the request, response to next filter or servlet
         //destination
        chain.doFilter(request,response);
    }
    
    public void destroy( ){
        /*called before the Filter instance is removed 
        from service by the web container*/
    }
}

The only reason we used the ServletContext.log( ) method was to display the inspection of parameters by the filter. Here is an example of the Tomcat log in <Tomcat-installation-directory>/logs showing the two parameters that were stored in the servlet request (last, first). In other words, the web browser request was http://localhost:8080/home/viewer?first=Bruce&last=Perry.

2003-04-13 17:13:33 doFilter called in: ParamSnoop on Sun Apr 13 17:13:33 EDT 2003
2003-04-13 17:13:33 Snooping the parameters in request: /home/viewer
2003-04-13 17:13:33 last: Perry
2003-04-13 17:13:33 first: Bruce

Recipe 7.9 Using a Filter to Read Parameter Values

Problem

Solution

Discussion

Example 7-14. Snooping on parameter values with a servlet

See Also