Tomcat 10.1.19 · org.apache.catalina.filters.RequestFilter

Implementation of a Filter that performs filtering based on comparing the appropriate request property (selected based on which subclass you choose to configure into your Container's pipeline) against the regular expressions configured for this Filter.

This filter is configured by setting the allow and/or deny properties to a regular expressions (in the syntax supported by Pattern) to which the appropriate request property will be compared. Evaluation proceeds as follows:

The subclass extracts the request property to be filtered, and calls the common process() method.
If there is a deny expression configured, the property will be compared to the expression. If a match is found, this request will be rejected with a "Forbidden" HTTP response.
If there is a allow expression configured, the property will be compared to the expression. If a match is found, this request will be allowed to pass through to the next filter in the current pipeline.
If a deny expression was specified but no allow expression, allow this request to pass through (because none of the deny expressions matched it).
The request will be rejected with a "Forbidden" HTTP response.

Field Summary

Modifier and Type	Field and Description
protected Pattern	allow The regular expression used to test for allowed requests.
protected Pattern	deny The regular expression used to test for denied requests.
protected int	denyStatus The HTTP response status code that is used when rejecting denied request.
private static final String	PLAIN_TEXT_MIME_TYPE mime type -- "text/plain"

Inherited from org.apache.catalina.filters.FilterBase:: sm

Constructor Summary

Access	Constructor and Description
public	RequestFilter()

Method Summary

Modifier and Type	Method and Description
public abstract void	doFilter(ServletRequest The servlet request to be processed request, ServletResponse The servlet response to be created response, FilterChain The filter chain chain) Redeclares jakarta.servlet.Filter.doFilter. Extract the desired request property, and pass it (along with the specified request and response objects) to the protected `process()` method to perform the actual filtering.
public String	Returns: the regular expression used to test for allowed requests for this Filter, if any; otherwise, return `null`. getAllow()
public String	Returns: the regular expression used to test for denied requests for this Filter, if any; otherwise, return `null`. getDeny()
public int	Returns: response status code that is used to reject denied request. getDenyStatus()
private boolean	Returns: `true` if this request should be allowed, `false` otherwise isAllowed(String The property to test against the allow and deny lists property) Process the allow and deny rules for the provided property.
protected boolean	isConfigProblemFatal() Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.
protected void	process(String The request property on which to filter property, ServletRequest The servlet request to be processed request, ServletResponse The servlet response to be processed response, FilterChain The filter chain chain) Perform the filtering that has been configured for this Filter, matching against the specified request property.
private void	sendErrorWhenNotHttp(ServletResponse response)
public void	setAllow(String The new allow expression allow) Set the regular expression used to test for allowed requests for this Filter, if any.
public void	setDeny(String The new deny expression deny) Set the regular expression used to test for denied requests for this Filter, if any.
public void	setDenyStatus(int The status code for deny denyStatus) Set response status code that is used to reject denied request.

Inherited from org.apache.catalina.filters.FilterBase:: getLogger init

Field Detail

allow	back to summary
protected Pattern allow The regular expression used to test for allowed requests.

deny	back to summary
protected Pattern deny The regular expression used to test for denied requests.

denyStatus	back to summary
protected int denyStatus The HTTP response status code that is used when rejecting denied request. It is 403 by default, but may be changed to be 404.

PLAIN_TEXT_MIME_TYPE	back to summary
private static final String PLAIN_TEXT_MIME_TYPE mime type -- "text/plain"

Constructor Detail

RequestFilter	back to summary
public RequestFilter()

Method Detail

doFilter back to summary

doFilter	back to summary
public abstract void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Redeclares jakarta.servlet.Filter.doFilter. Extract the desired request property, and pass it (along with the specified request and response objects) to the protected `process()` method to perform the actual filtering. This method must be implemented by a concrete subclass. Parameters request:ServletRequest The servlet request to be processed response:ServletResponse The servlet response to be created chain:FilterChain The filter chain Annotations @Override Exceptions IOException: if an input/output error occurs ServletException: if a servlet error occurs

public abstract void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Redeclares jakarta.servlet.Filter.doFilter.

Extract the desired request property, and pass it (along with the specified request and response objects) to the protected process() method to perform the actual filtering. This method must be implemented by a concrete subclass.

Parameters

request:ServletRequest: The servlet request to be processed
response:ServletResponse: The servlet response to be created
chain:FilterChain: The filter chain

Annotations

@Override

Exceptions

IOException:: if an input/output error occurs
ServletException:: if a servlet error occurs

getAllow	back to summary
public String getAllow() Returns:String the regular expression used to test for allowed requests for this Filter, if any; otherwise, return `null`.

getDeny	back to summary
public String getDeny() Returns:String the regular expression used to test for denied requests for this Filter, if any; otherwise, return `null`.

getDenyStatus	back to summary
public int getDenyStatus() Returns:int response status code that is used to reject denied request.

isAllowed back to summary

isAllowed	back to summary
private boolean isAllowed(String property) Process the allow and deny rules for the provided property. Parameters property:String The property to test against the allow and deny lists Returns:boolean `true` if this request should be allowed, `false` otherwise

private boolean isAllowed(String property)

Process the allow and deny rules for the provided property.

Parameters

property:String: The property to test against the allow and deny lists

Returns:boolean

true if this request should be allowed, false otherwise

isConfigProblemFatal back to summary

isConfigProblemFatal	back to summary
protected boolean isConfigProblemFatal() Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Doc from org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting. Returns:boolean `true` if a problem should trigger the failure of this filter, else `false` Annotations @Override

protected boolean isConfigProblemFatal()

Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Doc from org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.

Returns:boolean

true if a problem should trigger the failure of this filter, else false

Annotations

@Override

process	back to summary
protected void process(String property, ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Perform the filtering that has been configured for this Filter, matching against the specified request property. Parameters property:String The request property on which to filter request:ServletRequest The servlet request to be processed response:ServletResponse The servlet response to be processed chain:FilterChain The filter chain Exceptions IOException: if an input/output error occurs ServletException: if a servlet error occurs

process

back to summary

protected void process(String property, ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Perform the filtering that has been configured for this Filter, matching against the specified request property.

Parameters

property:String: The request property on which to filter
request:ServletRequest: The servlet request to be processed
response:ServletResponse: The servlet response to be processed
chain:FilterChain: The filter chain

Exceptions

IOException:: if an input/output error occurs
ServletException:: if a servlet error occurs

sendErrorWhenNotHttp	back to summary
private void sendErrorWhenNotHttp(ServletResponse response) throws IOException

setAllow	back to summary
public void setAllow(String allow) Set the regular expression used to test for allowed requests for this Filter, if any. Parameters allow:String The new allow expression

setAllow

back to summary

public void setAllow(String allow)

Set the regular expression used to test for allowed requests for this Filter, if any.

Parameters

allow:String: The new allow expression

setDeny	back to summary
public void setDeny(String deny) Set the regular expression used to test for denied requests for this Filter, if any. Parameters deny:String The new deny expression

setDeny

back to summary

public void setDeny(String deny)

Set the regular expression used to test for denied requests for this Filter, if any.

Parameters

deny:String: The new deny expression

setDenyStatus	back to summary
public void setDenyStatus(int denyStatus) Set response status code that is used to reject denied request. Parameters denyStatus:int The status code for deny

setDenyStatus

back to summary

public void setDenyStatus(int denyStatus)

Set response status code that is used to reject denied request.

Parameters

denyStatus:int: The status code for deny

public abstract Class RequestFilter

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail