Ето моята ситуация:
Имам уеб приложение в Eclipse. В момента това е уеб приложение на AspectJ.
Имам аспект в моята папка "src", наречен JSPCSRFTokenInjection.aj
, който има точки за улавяне на метода JspWriter.write
и някои други неща. Изглежда така:
package com.aspects;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.jsp.JspWriter;
import org.apache.log4j.Logger;
import com.thesis.aop.util.StopWatch;
public aspect JSPCSRFTokenInjection{
Logger logger;
StopWatch watch;
private String currentCSRFToken = null;
//Constuctor for the Aspect. I do some init of loggers and
//such here.
public JSPCSRFTokenInjection(){
//PropertyConfigurator.configure("log4j.properties");
logger = Logger.getLogger("csrfMitigationLogger");
logger.info("CSRF Injection Aspect Created");
watch = new StopWatch();
}
//Capturing the CSRF Token from the request by intercepting the
//_jspService method inside of the JSP
public pointcut csrf_jspServiceIntercept(HttpServletRequest req,
HttpServletResponse resp) :
call(public void _jspService(HttpServletRequest, HttpServletResponse))
&& args(req, resp);
before(HttpServletRequest req, HttpServletResponse resp) :
csrf_jspServiceIntercept(req, resp){
currentCSRFToken = (String) req.getParameter("csrfSalt");
logger.info("Got CSRF Token from request: " + currentCSRFToken);
}
//Pointcut and advice for capturing the writing into a JSP.
public pointcut csrf_captureFormWriting(String msg, JspWriter writer) :
call(public void JspWriter.write(String))
&& args(msg)
&& target(writer)
&& if(msg.toLowerCase().contains("</form>"));
before(String msg, JspWriter writer) : csrf_captureFormWriting(msg, writer){
try{
logger.info("WRITING TO JSP");
writer.write("TEST_CSRF");
writer.write("<input type='hidden' name='csrfSalt' value='" + currentCSRFToken + "'/>");
}
catch(Exception e){
e.printStackTrace();
}
}
}
Имам и файл aop.xml
в директорията WebApp/WebContent/META-INF/
. За справка моят web.xml
файл е в WebApp/WebContent/WEB-INF/
директория.
aop.xml
изглежда така:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE aspectj PUBLIC "-//AspectJ//DTD//EN" "http://www.eclipse.org/aspectj /dtd/aspectj.dtd">
<aspectj>
<weaver options="-showWeaveInfo -verbose -debug -Xset:weaveJavaPackages=true">
<!-- Weave types that are within the javax.* or org.aspectj.*
packages. Also weave all types in the foo package that do
not have the @NoWeave annotation. -->
<include within="javax.*"/>
<include within="com.*"/>
<include within="org.*"/>
<include within="org.aspectj.*"/>
</weaver>
<aspects>
<!-- declare two existing aspects to the weaver -->
<aspect name="com.aspects.JSPCSRFTokenInjection"/>
<aspect name="com.aspects.MitigateCSRFAspect"/>
<!-- Of the set of aspects declared to the weaver
use aspects matching the type pattern "com..*" for weaving. -->
<include within="com.*"/>
<include within="org.*"/>
<!-- Of the set of aspects declared to the weaver
do not use any aspects with the @CoolAspect annotation for weaving -->
</aspects>
</aspectj>
Също така добавям -javaagent:C:/aspectj1.6/lib/aspectjweaver.jar
към моите JVM параметри в Tomcat.
Ако помага, използвам приставката SysDeo за tomcat. Освен това сплитането по време на компилиране работи добре в други части на приложението, но не мога да вплета нито един от моите аспекти, засягащи JSP.
call(public void *._jspService(HttpServletRequest, HttpServletResponse)
със заместващия знак, за да представлява всеки тип - person Biju Kunjummen   schedule 11.08.2012