modify the HTTP Header with a Filter

[Florian Weber I]

Hello everybody,

I am using a Liferay 6.X Portal bundled with a Tomcat 6.0.29 Server.
I want to modify the HTTP-Header information (filtering line breaks in parameters to prevent a Header Injection) and I am trying to do that with a filter.
After finding this example: http://vangjee.wordpress.com/2009/02/25/how-to-modify-request-headers-in-a-j2ee-web-application/ I tried to rebuild it for my own purpose. As a first Test I deleted the cookie stuff so the filter is doing nothing but passing the data.

Everything went good, I got no Java Errors or something until I tried to add the Filter in my Configuration-File.
After adding the Filter, the Site crashes and I get a 404 response.

I am totally clueless what is going wrong, but I suspect the configuration written inside the web.xml:
<filter> <filter-name>simpleFilter</filter-name> <filter-class>com.myPortlet.utils.SimpleFilter</filter-class> </filter> <filter-mapping> <filter-name>simpleFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

My Filter Class looks like:

package com.myPortlet.utils;
import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

/**
 * A simple filter used to create an additional header.
 */
public class SimpleFilter implements Filter {

	public void destroy() {
				
	}

	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
			FilterChain filterChain) throws IOException, ServletException {
		//if the ServletRequest is an instance of HttpServletRequest
		if(servletRequest instanceof HttpServletRequest) {
			//cast the object
			HttpServletRequest httpServletRequest = (HttpServletRequest)servletRequest;
			//create the FakeHeadersRequest object to wrap the HttpServletRequest
			HttpHeaderFilter request = new HttpHeaderFilter(httpServletRequest);
			//continue on in the filter chain with the FakeHeaderRequest and ServletResponse objects
			filterChain.doFilter(request, servletResponse);
		} else {
			//otherwise, continue on in the chain with the ServletRequest and ServletResponse objects
			filterChain.doFilter(servletRequest, servletResponse);
		}		
		
		return;
	}

	public void init(FilterConfig filterConfig) throws ServletException {
		
	}

}

and the class where I want to modify the header data:

package com.myPortlet.utils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class HttpHeaderFilter extends HttpServletRequestWrapper {
    
    public HttpHeaderFilter(HttpServletRequest request){
        super(request);
    }
    
    @Override
    public String getHeader(String name) {
        //get the request object and cast it
        HttpServletRequest request = (HttpServletRequest)getRequest();
        
        return request.getHeader(name);
    }
    
}

It would be very great if someone could help me out with that!

[Florian Weber I]

Well, I finally had some progress on this issue.

For Liferay you need to use specific Render- and Action Filters and configure them in your portlet.xml.
This is what you need to configure in your Portlet.xml:

<filter>
	<filter-name>SimpleFilter</filter-name>
	<filter-class>com.myPortlet.test.NewPortletFilter</filter-class>
	<lifecycle>RENDER_PHASE</lifecycle>
	<lifecycle>ACTION_PHASE</lifecycle>
</filter>
<filter-mapping>
	<filter-name>SimpleFilter</filter-name>
	<portlet-name>HelloWorld</portlet-name>
</filter-mapping>

And this is my Filter so far:

package com.myPortlet.test;

import java.io.IOException;
import java.util.Enumeration;
import javax.portlet.PortletException;

import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;
import javax.portlet.filter.RenderFilter;
import javax.portlet.ActionRequest;
import javax.portlet.ActionResponse;
import javax.portlet.filter.ActionFilter;
import javax.portlet.filter.FilterChain;
import javax.portlet.filter.FilterConfig;

/**
 * NewPortletFilter Filter Class
 */
public class NewPortletFilter implements RenderFilter, ActionFilter {
    
    private FilterConfig filterConfig = null;
    
    public void init(FilterConfig filterConfig) throws PortletException {
        this.filterConfig = filterConfig;
    }

    public void doFilter(RenderRequest renderRequest, RenderResponse renderResponse, FilterChain filterChain) throws IOException, PortletException {
        System.out.println("+++++++++++++++++++++++++++++++++++++++++++++++++++++");
        System.out.println("I WAS IN THE RENDER FILTER FUNCTION");
        System.out.println("+++++++++++++++++++++++++++++++++++++++++++++++++++++");
        
        System.out.println("+++++++ATTRIBUTE NAMES+++++++");
        Enumeration<String> AttributeNames = renderRequest.getAttributeNames();
                
        while(AttributeNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+AttributeNames.nextElement());
        }
        
        System.out.println("+++++++PARAMETER NAMES+++++++");
        Enumeration<String> ParameterNames = renderRequest.getParameterNames();
                
        while(ParameterNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+ParameterNames.nextElement());
        }
        
        System.out.println("+++++++PROPERTY NAMES+++++++");
        Enumeration<String> PropertyNames = renderRequest.getPropertyNames();
                
        while(PropertyNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+PropertyNames.nextElement());
        }
        
        
        //otherwise, continue on in the chain with the ServletRequest and ServletResponse objects
        filterChain.doFilter(renderRequest, renderResponse);
       	

        return;
    }


    public void destroy() {
    }

    public void doFilter(ActionRequest request, ActionResponse response, FilterChain chain) throws IOException, PortletException {
        System.out.println("+++++++++++++++++++++++++++++++++++++++++++++++++++++");
        System.out.println("I WAS IN THE ACTION FILTER FUNCTION");
        System.out.println("+++++++++++++++++++++++++++++++++++++++++++++++++++++");
        
        System.out.println("+++++++ATTRIBUTE NAMES+++++++");
        Enumeration<String> AttributeNames = request.getAttributeNames();
                
        while(AttributeNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+AttributeNames.nextElement());
        }
        
        System.out.println("+++++++PARAMETER NAMES+++++++");
        Enumeration<String> ParameterNames = request.getParameterNames();
                
        while(ParameterNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+ParameterNames.nextElement());
        }
        
        System.out.println("+++++++PROPERTY NAMES+++++++");
        Enumeration<String> PropertyNames = request.getPropertyNames();
                
        while(PropertyNames.hasMoreElements()){
            System.out.println("Generic stuff to see if it is my println... and: "+PropertyNames.nextElement());
        }
        
        
        //otherwise, continue on in the chain with the ServletRequest and ServletResponse objects
        chain.doFilter(request, response);
       	

        return;
    }
}

The Problem I now have is that my ActionRequest has only the Portlet Parameters and I can't filter the Liferay Specific Parameters (p_auth, p_p_id, p_p_lifecycle, p_p_state, p_p_mode, p_p_col_id, p_p_col_count).

Can anyone give me some input on this problem, please?