Spring Boot 中getReader() has already been called问题处理

1、问题：HttpServletRequest 的 getInputStream() 和 getReader() 都只能读取一次，由于 Request Body 是流的形式读取，流读了一次就没有，所以只能被调用一次，调用第二次就报错了。

2、解决方案：自定义HttpServletRequest包装类BodyReaderHttpServletRequestWrapper，然后放到过滤链

具体：先将 Request Body 保存，然后通过 Servlet 自带的 HttpServletRequestWrapper 类覆盖 getReader() 和getInputStream() 方法，使流从保存的body读取。然后再Filter中将ServletRequest替换为AuthenticationRequestWrapper。

package cn.gbits.oa.kernelsdk.security.xss;

import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.HashMap;
import java.util.Map;

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.springframework.util.StringUtils;

import cn.gbits.oa.kernelsdk.utils.JsoupUtil;
import cn.gbits.oa.kernelsdk.utils.SerializeUtils;


public class BodyReaderHttpServletRequestWrapper extends HttpServletRequestWrapper {
    private String requestBody = null;
    HttpServletRequest orgRequest = null;
    private boolean isIncludeRichText = false;
    private Map requestMap = null;

    public BodyReaderHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
        if (requestBody == null) {
            try {
                requestMap = new HashMap();
                requestBody = JsoupUtil.clean(readBody(request)).replaceAll(" ", "").replaceAll("&", "&");

                
            } catch (Exception ex) {

            }
        }
    }

    public String getRequestBody() {
        return requestBody;
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new CustomServletInputStream(requestBody);
    }

    @Override
    public Map getParameterMap() {
        return requestMap;
    }

    private static String readBody(ServletRequest request) {
        StringBuilder sb = new StringBuilder();
        String inputLine;
        BufferedReader br = null;
        try {
            br = request.getReader();
            while ((inputLine = br.readLine()) != null) {
                sb.append(inputLine);
            }
        } catch (IOException e) {
            throw new RuntimeException("Failed to read body.", e);
        } finally {
            if (br != null) {
                try {
                    br.close();
                } catch (IOException e) {
                }
            }
        }
        return sb.toString();
    }

    private class CustomServletInputStream extends ServletInputStream {
        private ByteArrayInputStream buffer;

        public CustomServletInputStream(String body) {
            body = body == null ? "" : body;
            this.buffer = new ByteArrayInputStream(body.getBytes());
        }

        @Override
        public int read() throws IOException {
            return buffer.read();
        }

        @Override
        public boolean isFinished() {
            return buffer.available() == 0;
        }

        @Override
        public boolean isReady() {
            return true;
        }

        @Override
        public void setReadListener(ReadListener listener) {
            throw new RuntimeException("Not implemented");
        }
    }

    
    @Override
    public String getParameter(String name) {
        if (("content".equals(name) || name.endsWith("WithHtml")) && !isIncludeRichText) {
            return super.getParameter(name);
        }
        name = JsoupUtil.clean(name);
        String value = super.getParameter(name);
        if (!StringUtils.isEmpty(value)) {
            value = JsoupUtil.clean(value);
        }
        return value;
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] arr = super.getParameterValues(name);

        if (arr != null) {
            for (int i = 0; i < arr.length; i++) {
                arr[i] = JsoupUtil.clean(arr[i]);
            }
        } else {
            if (!this.requestBody.isEmpty()) {
                arr = new String[1];
                arr[0] = SerializeUtils.getStringFromJsonNode(SerializeUtils.convertJsonString2ObjectNode(this.requestBody), name);
            }
        }
        return arr;
    }

    
    @Override
    public String getHeader(String name) {
        name = JsoupUtil.clean(name);
        String value = super.getHeader(name);
        if (!StringUtils.isEmpty(value)) {
            value = JsoupUtil.clean(value);
        }
        return value;
    }

    
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof BodyReaderHttpServletRequestWrapper) {
            return ((BodyReaderHttpServletRequestWrapper) req).getOrgRequest();
        }

        return req;
    }

}

package cn.gbits.oa.security.xss;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.springframework.web.filter.GenericFilterBean;


public class FileTranFilter extends GenericFilterBean {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        BodyReaderHttpServletRequestWrapper myRequest = new BodyReaderHttpServletRequestWrapper((HttpServletRequest) request);
        filterChain.doFilter(myRequest, response);
    }
}

package cn.qh.filecenter.config;

import cn.gbits.oa.kernelsdk.accesslog.AccessLoggingFilter;
import cn.gbits.oa.kernelsdk.config.HttpSessionConfig;
import cn.gbits.oa.kernelsdk.security.xss.KernelTranFilter;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableAsync;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.web.cors.CorsUtils;
import org.springframework.web.filter.CorsFilter;


@Configuration
@EnableWebSecurity
public class FileCenterConfig extends HttpSessionConfig{
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.csrf().disable()
				.cors()
				.and()
				.authorizeRequests().requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
				.and()
				.addFilterAfter(new AccessLoggingFilter(), CorsFilter.class)
				.addFilterAfter(new FileTranFilter(), AccessLoggingFilter.class)
				.addFilterAfter(SessionFilter.getInstance(),AccessLoggingFilter.class)
    			;
	}
}

3、特别注意：如果当前服务需要兼容form-data表单请求，还需要将 hiddenmethod 过滤器设置为启用，即在Spring Boot 的配置文件 application.properties加上以下配置即可

spring.mvc.hiddenmethod.filter.enabled=true

原因是在 Spring Boot 的 META-INF/spring-configuration-metadata.json 配置文件中，默认是关闭 Spring 的 hiddenmethod 过滤器的，只有在开启时，可以将请求转换为标准的http方法，使得支持GET、POST、PUT与DELETE请求，该过滤器为HiddenHttpMethodFilter。