View Javadoc

    1   /*
    2    * Copyright 2004-2009 the Seasar Foundation and the Others.
    3    *
    4    * Licensed under the Apache License, Version 2.0 (the "License");
    5    * you may not use this file except in compliance with the License.
    6    * You may obtain a copy of the License at
    7    *
    8    *     http://www.apache.org/licenses/LICENSE-2.0
    9    *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
    13   * either express or implied. See the License for the specific language
    14   * governing permissions and limitations under the License.
    15   */
    16  package org.seasar.cubby.tags;
    17
    18  import static org.seasar.cubby.tags.TagUtils.toAttr;
    19
    20  import java.io.IOException;
    21
    22  import javax.servlet.http.HttpServletRequest;
    23  import javax.servlet.http.HttpSession;
    24  import javax.servlet.jsp.JspException;
    25  import javax.servlet.jsp.JspWriter;
    26  import javax.servlet.jsp.PageContext;
    27
    28  import org.seasar.cubby.internal.util.StringUtils;
    29  import org.seasar.cubby.internal.util.TokenHelper;
    30  import org.seasar.cubby.validator.validators.TokenValidator;
    31
    32  /**
    33   * 2重サブミット防止用の <code>&lt;input type="hidden"/&gt;</code> タグを出力するタグ。
    34   * <p>
    35   * このタグが呼び出されると一意なトークン文字列を生成して hidden とセッションに格納します。 サブミットされた先の処理の検証フェーズで、ポストされた
    36   * hidden 値とセッション中の値を比較して、 一致しない場合、不正な経路からのアクセスとみなしてエラー処理を行います。
    37   * </p>
    38   *
    39   * @see TokenValidator#validate(org.seasar.cubby.validator.ValidationContext,
    40   *      Object[])
    41   * @author agata
    42   */
    43  public class TokenTag extends DynamicAttributesSimpleTagSupport {
    44
    45  	private String name;
    46
    47  	/**
    48  	 * name属性を設定します。
    49  	 *
    50  	 * @param name
    51  	 *            name属性
    52  	 */
    53  	public void setName(final String name) {
    54  		this.name = name;
    55  	}
    56
    57  	/**
    58  	 * {@inheritDoc}
    59  	 */
    60  	@Override
    61  	public void doTag() throws JspException, IOException {
    62  		final PageContext context = (PageContext) getJspContext();
    63  		final JspWriter out = context.getOut();
    64
    65  		final String token = TokenHelper.generateGUID();
    66  		final PageContext pageContext = (PageContext) getJspContext();
    67  		final HttpServletRequest request = (HttpServletRequest) pageContext
    68  				.getRequest();
    69  		final HttpSession session = request.getSession();
    70  		TokenHelper.setToken(session, token);
    71
    72  		out.append("<input type=\"hidden\" name=\"");
    73  		if (StringUtils.isEmpty(name)) {
    74  			out.append(TokenHelper.DEFAULT_TOKEN_NAME);
    75  		} else {
    76  			out.append(name);
    77  		}
    78  		out.append("\" value=\"");
    79  		out.append(token);
    80  		out.append("\" ");
    81  		out.write(toAttr(getDynamicAttributes()));
    82  		out.append("/>");
    83  	}
    84
    85  }