[FIXED] How to eliminate special characters before hitting the controller in Java?

Issue

I have a use case where I need to verify if the incoming request body to my controller contains any special characters in a Hybris storefront. Though it can be achieved from the front-end by blocking any special characters, we require back-end validation.

I tried using HandlerIntercepterAdapter to intercept the request and validate for any special characters. But whenever I use request.getReader() or request.getInputStream() and read the data, request body is cleared. I tried using IOUtils.copy() but this too reads from the original request and makes the body empty. Even after wrapping the request with HttpServletRequestWrapper or ContentCachingRequestWrapper, the request body gets cleared. I guess internally somewhere it uses the same reference. I tried following this thread but was unable to solve this issue.

I am looking for a solution where I can extract the request body and validate it without letting it get cleared so it can be used in different controllers [or] any alternative approach which can help in preventing any special characters to hit the controller.

Solution

any alternative approach which can help in preventing any special characters to hit the controller.

What if you try to do the following ...

1. Get the request body
2. Process it
3. Set the request body again in your filter by setting the body to the processed version ?

@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
       
        HttpServletRequest originalRequest = (HttpServletRequest) request;
        HttpServletResponse originalResponse = (HttpServletResponse) response;

        /**
         * 2.Read the original request body and change it
         */
        String originalRequestBody = ServletUtil.readRequestBody(originalRequest); // Read the original request body
        // Body is processed here !
        String modifyRequestBody = processBody(originalRequestBody); // Modify request body (clear text)
        HttpServletRequest orginalRequest = (HttpServletRequest) request;
        ModifyRequestBodyWrapper requestWrapper = new ModifyRequestBodyWrapper(orginalRequest, modifyRequestBody);

        /**
         * 3. Build a new response object
         */
        ModifyResponseBodyWrapper responseWrapper = new ModifyResponseBodyWrapper(originalResponse);
        chain.doFilter(requestWrapper, responseWrapper);
        String originalResponseBody = responseWrapper.getResponseBody(); // Original response body (clear text)
        String modifyResponseBody = this.encryptBody(originalResponseBody); // Modified response volume (ciphertext)

        /**
         * 4.Output the modified response body with the output stream of the original response object
         * To ensure that the response type is consistent with the original request, and reset the response body size
         */
        originalResponse.setContentType(requestWrapper.getOrginalRequest().getContentType()); // Be consistent with the request
        byte[] responseData = modifyResponseBody.getBytes(responseWrapper.getCharacterEncoding()); // The coding is consistent with the actual response
        originalResponse.setContentLength(responseData.length);
        @Cleanup ServletOutputStream out = originalResponse.getOutputStream();
        out.write(responseData);
    }

Here is a code example, which implements this.

Answered By - Arthur Klezovich
Answer Checked By - Mary Flores (JavaFixing Volunteer)