{"id":326902,"date":"2023-09-05T02:44:36","date_gmt":"2023-09-05T02:44:36","guid":{"rendered":"https:\/\/www.baeldung.com\/java-servlet-request-set-parameter"},"modified":"2023-09-05T02:44:36","modified_gmt":"2023-09-05T02:44:36","slug":"set-a-parameter-in-an-httpservletrequest-in-java","status":"publish","type":"post","link":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/2023\/09\/05\/set-a-parameter-in-an-httpservletrequest-in-java\/","title":{"rendered":"Set a Parameter in an HttpServletRequest in Java"},"content":{"rendered":"

<\/p>\n

\"\"<\/p>\n

1. Overview<\/h2>\n
<\/div>\n

When developing web applications in Java using the Servlet API<\/a>, the HttpServletRequest<\/em> object plays a key role in processing incoming HTTP requests. It provides access to various aspects of the request such as parameters, headers, and attributes.<\/p>\n

Request parameters are always supplied by the HTTP client. However, there are scenarios where we might need to set parameters programmatically within the HttpServletRequest<\/em> object before it’s processed by our application.<\/p>\n

It’s important to note that HttpServletRequest<\/em> lacks setter methods for adding new parameters or altering parameter values. <\/strong>In this article, we’ll explore how to achieve this by extending the functionalities of the original HttpServletRequest<\/em>.<\/p>\n

2. Maven Dependencies<\/h2>\n
<\/div>\n

In addition to the standard Java Servlet<\/a> API:<\/p>\n

<dependency>\r\n    <groupId>javax.servlet<\/groupId>\r\n    <artifactId>javax.servlet-api<\/artifactId>\r\n    <version>4.0.1<\/version>\r\n    <scope>provided<\/scope>\r\n<\/dependency><\/code><\/pre>\n
We’ll also use the commons-text<\/a> library in one of our use cases to sanitize request parameters by escaping HTML entities:<\/p>\n
<dependency>\r\n    <groupId>org.apache.commons<\/groupId>\r\n    <artifactId>commons-text<\/artifactId>\r\n    <version>1.10.0<\/version>\r\n<\/dependency><\/code><\/pre>\n
3. Essential Servlet Components<\/h2>\n
<\/div>\n
Before we dive into the real-world usage examples, let’s take a quick look at some foundational Servlet components that we’ll make use of.<\/p>\n
3.1. HttpServletRequest<\/em><\/h3>\n
<\/div>\n
The HttpServletRequest<\/em> class is the primary means of communication between clients and Servlets. It encapsulates incoming HTTP requests<\/strong>, providing access to parameters, headers, and other request-related information.<\/p>\n
3.2. HttpServletRequestWrapper<\/em><\/h3>\n
<\/div>\n
The HttpServletRequestWrapper<\/em> extends the capabilities of HttpServletRequest<\/em> by acting as a decorator<\/a> of an existing HttpServletRequest<\/em> object. This allows us to attach additional responsibilities<\/strong> according to our specific needs.<\/p>\n
3.3. Filter<\/em><\/h3>\n
<\/div>\n
A Filter<\/em><\/a> captures and processes requests and responses as they traverse the servlet container. These Filters<\/em> are designed to invoke before Servlet execution, empowering them to alter both incoming requests and outgoing responses<\/strong>.<\/p>\n
4. Parameter Sanitization<\/h2>\n
<\/div>\n
One of the applications of setting parameters programmatically within HttpServletRequest<\/em> is to sanitize request parameters, effectively mitigating Cross-Site Scripting (XSS)<\/a> vulnerabilities. This procedure involves the elimination or encoding of potentially harmful characters from user input, thus enhancing the security of the web application.<\/strong><\/p>\n
4.1. Example<\/h3>\n
<\/div>\n
Now, let’s explore the process in detail. First of all, we have to set up a Servlet Filter<\/em> to intercept the requests. The filter provides a way to modify the request and response before it reaches the target Servlet or JSP.<\/p>\n
Here’s a concrete example of a Servlet Filter<\/em> that intercepts all requests to a specific URL pattern, ensuring the filter chain returns the SanitizeParametersRequestWrapper<\/em> over the original HttpSevletRequest<\/em> object:<\/p>\n
@WebFilter(urlPatterns = {"\/sanitize\/with-sanitize.jsp"})\r\npublic class SanitizeParametersFilter implements Filter {\r\n    @Override\r\n    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)\r\n            throws IOException, ServletException {\r\n        HttpSerlvetRequest httpReq = (HttpSerlvetRequest) request;\r\n        chain.doFilter(new SanitizeParametersRequestWrapper(httpReq), response);\r\n    }\r\n}<\/code><\/pre>\n
The class SanitizeParameterRequestWrapper<\/em> extends HttpServletRequestWrapper<\/em>. This plays a crucial role in the parameter sanitization process. This class is designed to sanitize the request parameters from the original HttpServletRequest<\/em> and expose only the sanitized parameters to the calling JSP:<\/p>\n
public class SanitizeParametersRequestWrapper extends HttpServletRequestWrapper {\r\n    private final Map<String, String[]> sanitizedMap;\r\n    public SanitizeParametersRequestWrapper(HttpServletRequest request) {\r\n        super(request);\r\n        sanitizedMap = Collections.unmodifiableMap(\r\n            request.getParameterMap().entrySet().stream()\r\n                .collect(Collectors.toMap(\r\n                  Map.Entry::getKey,\r\n                  entry -> Arrays.stream(entry.getValue())\r\n                    .map(StringEscapeUtils::escapeHtml4)\r\n                    .toArray(String[]::new)\r\n                )));\r\n    }\r\n    @Override\r\n    public Map<String, String[]> getParameterMap() {\r\n        return sanitizedMap;\r\n    }\r\n    @Override\r\n    public String[] getParameterValues(String name) {\r\n        return Optional.ofNullable(getParameterMap().get(name))\r\n            .map(values -> Arrays.copyOf(values, values.length))\r\n            .orElse(null);\r\n    }\r\n    @Override\r\n    public String getParameter(String name) {\r\n        return Optional.ofNullable(getParameterValues(name))\r\n            .map(values -> values[0])\r\n            .orElse(null);\r\n    }\r\n}<\/code><\/pre>\n
In the constructor, we iterate over each request parameter and use StringEscapeUtils.escapeHtml4<\/em> to sanitize the value. The processed parameters are collected in a new sanitized map.<\/p>\n
We override the getParameter<\/em> method to return the corresponding parameter from the sanitized map instead of the original request parameters. Even though the getParameter<\/em> method is the primary focus of use, it’s vital to override getParameterMap<\/em>\u00a0and getParameterValues<\/em>,\u00a0too. We ensure consistent behavior among all parameter retrieval methods and maintain security standards throughout them.<\/strong><\/p>\n
As per the specification, the getParameterMap<\/em>\u00a0method guarantees an unmodifiable map that prevents changing the internal values. Hence, it’s important to adhere to this contract and to ensure that the override also returns an unmodifiable map. <\/strong>Similarly, the overridden getParameterValues<\/em> method returns a cloned array instead of its internal value.<\/p>\n
Now, let’s create a JSP to illustrate our work. It simply renders the value of the input<\/em> request parameter on the screen:<\/p>\n
The text below comes from request parameter "input":<br\/>\r\n<%=request.getParameter("input")%><\/code><\/pre>\n
4.2. Results<\/h3>\n
<\/div>\n
Now, let’s run the JSP without the sanitization filter activated. We’ll inject a script tag to the request parameter as a reflected XSS:<\/p>\n
http:\/\/localhost:8080\/sanitize\/without-sanitize.jsp?input=<script>alert('Hello');<\/script><\/code><\/pre>\n
We’ll see that the JavaScript embedded in the parameter is being executed by the browser:<\/p>\n
<\/p>\n
Next, we’ll run the sanitized version:<\/p>\n
http:\/\/localhost:8080\/sanitize\/with-sanitize.jsp?input=<script>alert('Hello');<\/script><\/code><\/pre>\n
In this case, the filter will capture the request and pass the SanitizeParameterRequestWrapper<\/em> to the calling JSP. As a result, the popup will no longer appear. Instead, we’ll observe that HTML entities are escaped and visibly rendered on the screen:<\/p>\n
The text below comes from request parameter "input":\r\n<script>alert('Hello');<\/script><\/code><\/pre>\n
5. Third-Party Resource Access<\/h2>\n
<\/div>\n
Let’s consider another scenario where a third-party module accepts a request parameter locale<\/em> to change the language displayed by the module. Note that we are unable to modify the source code of the third-party module directly.<\/p>\n
In our example, we’ll set the locale<\/em> parameter to the default system locale. However, it could also be taken from another source, such as the HTTP session.<\/p>\n
5.1. Example<\/h3>\n
<\/div>\n
The third-party module is a JSP page:<\/p>\n
<%\r\n    String localeStr = request.getParameter("locale");\r\n    Locale currentLocale = (localeStr != null ? new Locale(localeStr) : null);\r\n%>\r\nThe language you have selected: <%=currentLocale != null ? currentLocale.getDisplayLanguage(currentLocale) : " None"%><\/code><\/pre>\n
If the locale<\/em> parameter is provided, the module displays the language name.<\/p>\n
We’ll provide the default system language Locale.getDefault().getLanguage()<\/em> to the target request parameter. To do this, let’s set the locale<\/em> parameter in our SetParameterRequestWrapper<\/em>, which decorates the original HttpServletRequest<\/em>:<\/p>\n
@WebServlet(name = "LanguageServlet", urlPatterns = "\/setparam\/lang")\r\npublic class LanguageServlet extends HttpServlet {\r\n    @Override\r\n    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {\r\n        SetParameterRequestWrapper requestWrapper = new SetParameterRequestWrapper(request);\r\n        requestWrapper.setParameter("locale", Locale.getDefault().getLanguage());\r\n        request.getRequestDispatcher("\/setparam\/3rd_party_module.jsp").forward(requestWrapper, response);\r\n    }\r\n}<\/code><\/pre>\n
We’ll take a similar approach to the previous section when creating the SetParameterRequestWrapper<\/em>. In addition, we’ll implement the setParameter<\/em>\u00a0method to add a new parameter to the existing parameter map:<\/p>\n
public class SetParameterRequestWrapper extends HttpServletRequestWrapper {\r\n    private final Map<String, String[]> paramMap;\r\n    public SetParameterRequestWrapper(HttpServletRequest request) {\r\n        super(request);\r\n        paramMap = new HashMap<>(request.getParameterMap());\r\n    }\r\n    @Override\r\n    public Map<String, String[]> getParameterMap() {\r\n        return Collections.unmodifiableMap(paramMap);\r\n    }\r\n    public void setParameter(String name, String value) {\r\n        paramMap.put(name, new String[] {value});\r\n    }\r\n    \/\/ getParameter() and getParameterValues() are the same as SanitizeParametersRequestWrapper\r\n}<\/code><\/code><\/pre>\n
The getParameter<\/em> method retrieves parameters stored within the paramMap<\/em> instead of the original request.<\/p>\n
5.2. Results<\/h3>\n
<\/div>\n
LangaugeServlet<\/em> passes the locale parameter to the third-party module via SetParameterRequestWrapper<\/em>. We’ll see the following when we access the third-party module on an English language server:<\/p>\n
The language you have selected: English<\/code><\/pre>\n
6. Conclusion<\/h2>\n
<\/div>\n
In this article, we looked at some important Servlet components that we can use in Java web application development to handle client requests. These include HttpServletRequest<\/em>, HttpServletRequestWrapper<\/em>, and Filter<\/em>.<\/p>\n
Through concrete examples, we’ve demonstrated how to extend the capabilities of HttpServletRequest<\/em> to programmatically set and modify request parameters.<\/strong><\/p>\n
Whether it’s for enhancing security by sanitizing user input or integrating with third-party resources, these techniques empower developers to cope with diverse scenarios.<\/p>\n
As usual, the full source code for this example is available over on GitHub<\/a>.<\/p>\n
\"\"<\/p>\n
<\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/div>\n\n
\\\"IT\u96fb\u8166\u88dc\u7fd2
\u7acb\u523b\u8a3b\u518a\u53ca\u5831\u540d\u96fb\u8166\u88dc\u7fd2\u8ab2\u7a0b\u5427!<\/figcaption><\/figure>\r\n<\/br>Find A Teacher Form:\r\n<\/br>https:\/\/docs.google.com\/forms\/d\/1vREBnX5n262umf4wU5U2pyTwvk9O-JrAgblA-wH9GFQ\/viewform?edit_requested=true#responses\r\n<\/br><\/br>Email:\r\n<\/br>public1989two@gmail.com






\r\nwww.itsec.hk<\/a>
\r\nwww.itsec.vip<\/a>
\r\nwww.itseceu.uk<\/a>
<\/p>","protected":false},"excerpt":{"rendered":"
\"\"<\/p>\n
Learn how to modify a Servlet API request to set parameters that were not in the original HTTP request.<\/p>\n
<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/div>\n<\/div>","protected":false},"author":1978,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"Set a Parameter in an HttpServletRequest in Java - ITTeacherITFreelance.hk","description":"Learn how to modify a Servlet API request to set parameters that were not in the original HTTP request. \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0"},"footnotes":""},"categories":[6,1307],"tags":[10568,10569],"_links":{"self":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/326902"}],"collection":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/users\/1978"}],"replies":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/comments?post=326902"}],"version-history":[{"count":1,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/326902\/revisions"}],"predecessor-version":[{"id":326903,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/326902\/revisions\/326903"}],"wp:attachment":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/media?parent=326902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/categories?post=326902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/tags?post=326902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}