API安全(五)-参数校验

/**
 * @author caofanqi
 * @date 2020/1/20 13:08
 */
@Data
public class UserDTO {

    @Null(message = "创建用户时，id必须为null")
    private Long id;
    
    @NotNull(message = "名称不能为空")
    private String name;

    @NotBlank(message = "用户名不能为空")
    private String username;

    @NotBlank(message = "密码不能为空")
    private String password;

}

@Validated
@RestController
@RequestMapping("/users")
public class UserController {
......
}

    @PostMapping
    public UserDTO create(@RequestBody @Validated UserDTO userDTO){
        return userService.create(userDTO);
    }

/**
 * 异常处理器
 *
 * @author caofanqi
 * @date 2020/1/27 21:17
 */
@RestControllerAdvice
public class ControllerAdvice {


    /**
     * @param e 参数校验异常
     * @return 具体不符合规范的参数及其原因
     */
    @ExceptionHandler
    @ResponseStatus(code = HttpStatus.BAD_REQUEST)
    public Map exceptionHandler(org.springframework.web.bind.MethodArgumentNotValidException e) {
        return e.getBindingResult().getFieldErrors().stream()
                .collect(Collectors.toMap(FieldError::getField, FieldError::getDefaultMessage));
    }


}

/**
 *  新增分组
 * @author caofanqi
 * @date 2020/1/27 21:39
 */
public interface Create extends Default {
}

/**
 * 修改分组
 * @author caofanqi
 * @date 2020/1/27 21:40
 */
public interface Update extends Default {
}

    @Null(groups = Create.class,message = "创建用户时，id必须为null")
    @NotNull(groups = Update.class,message = "修改用户时，必须有id")
    private Long id;

    @PostMapping
    public UserDTO create(@RequestBody @Validated(Create.class) UserDTO userDTO){
        return userService.create(userDTO);
    }

    @PutMapping
    public UserDTO update(@RequestBody @Validated(Update.class) UserDTO userDTO) {
        return userService.update(userDTO);
    }

/**
 * 用户详情，为了测试级联校验
 *
 * @author caofanqi
 * @date 2020/1/27 22:39
 */
@Data
public class UserInfoDTO {

    @NotBlank(message = "手机号不能为空")
    @Pattern(regexp="^[1]([3-9])[0-9]{9}$",message="手机号格式不正确")
    private String phone;

}

    @Valid
    @NotNull(message = "用户详情不能为空")
    private UserInfoDTO userInfo;

/**
 * 自定义校验注解，具体的校验逻辑由@Constraint进行指定，可以指定多个
 *
 * @author caofanqi
 */
@Documented
@Target({FIELD})
@Retention(RUNTIME)
@Constraint(validatedBy = {CustomConstraintValidatorForString.class, CustomConstraintValidatorForList.class})
public @interface CustomConstraint {

    String message() default "自定义校验注解";

    Class>[] groups() default {};

    Class extends Payload>[] payload() default {};

    int value() default 0;


}

/**
 * 自定义注解校验器，实现ConstraintValidator接口，并指定要校验的注解和要校验的类型，
 * initialize可以获得注解上的属性，进行初始化；isValid校验逻辑。
 *
 * @author caofanqi
 * @version 1.0.0
 * @date 2020/1/27 23:17
 */
@Slf4j
public class CustomConstraintValidatorForString implements ConstraintValidator {

    private int value;

    @Override
    public void initialize(CustomConstraint constraintAnnotation) {
        value = constraintAnnotation.value();
    }

    @Override
    public boolean isValid(String value, ConstraintValidatorContext context) {
        if (value == null) {
            return true;
        }
        log.info("自定义校验的参数值是：{}，注解上的值是：{}",value,this.value);
        return true;
    }


}

    @PostMapping("/batch")
    @Validated(Create.class)
    public void batchCreate(@RequestBody  List userDTOS){
        userService.batchCreate(userDTOS);
    }

    /**
     * @param e 参数校验异常2
     * @return 具体不符合规范的路径及其原因
     */
    @ExceptionHandler
    @ResponseStatus(code = HttpStatus.BAD_REQUEST)
    public Map exceptionHandler(javax.validation.ConstraintViolationException e){
        return e.getConstraintViolations().stream()
                .collect(Collectors.toMap(ConstraintViolation::getPropertyPath, ConstraintViolation::getMessage));
    }

/**
 * 自定义类级别注解
 * @author caofanqi
 */
@Documented
@Target({TYPE})
@Retention(RUNTIME)
@Constraint(validatedBy = {UserDTOConstraintValidator.class})
public @interface UserDTOConstraint {

    String message() default "";

    Class>[] groups() default {};

    Class extends Payload>[] payload() default {};

}

/**
 * 自定义UserDTO类校验器
 *
 * @author caofanqi
 * @date 2020/1/28 1:36
 */
@Slf4j
public class UserDTOConstraintValidator implements ConstraintValidator {


    @Override
    public boolean isValid(UserDTO value, ConstraintValidatorContext context) {

        if (value.getName().equals(value.getUsername())){
            /*
             * 更改错误消息
             */
            context.disableDefaultConstraintViolation();
            context.buildConstraintViolationWithTemplate("名称不能和用户名相同")
                    .addPropertyNode("name").addConstraintViolation();

            return false;
        }

        return true;
    }
}

@Data
@UserDTOConstraint(message = "default message")
public class UserDTO {
......
}