JSP 自訂標籤實作 forEach 遍歷 Map/Collection/陣列與 HTML 轉義標籤

通用 forEach 標籤（支援 Map、Collection、陣列）

標籤處理類 ForEachTag2

public class ForEachTag2 extends SimpleTagSupport {
    private String var;
    private Object items;
    private Collection collection;

    public void setVar(String var) { this.var = var; }
    public void setItems(Object items) {
        this.items = items;
        if (items instanceof Map) {
            collection = ((Map) items).entrySet();
        } else if (items instanceof Collection) {
            collection = (Collection) items;
        } else if (items.getClass().isArray()) {
            collection = new ArrayList();
            int len = Array.getLength(items);
            for (int i = 0; i < len; i++) collection.add(Array.get(items, i));
        }
    }

    @Override
    public void doTag() throws JspException, IOException {
        Iterator it = collection.iterator();
        while (it.hasNext()) {
            Object obj = it.next();
            this.getJspContext().setAttribute(var, obj);
            this.getJspBody().invoke(null);
        }
    }
}

TLD 定義

<tag>
    <name>forEach2</name>
    <tag-class>com.csdn.items.ForEachTag2</tag-class>
    <body-content>scriptless</body-content>
    <attribute><name>var</name><required>true</required></attribute>
    <attribute><name>items</name><required>true</required><rtexprvalue>true</rtexprvalue></attribute>
</tag>

JSP 使用範例

<% Map map = new HashMap(); map.put("aa","aaaa"); map.put("bb","bbbb"); request.setAttribute("map", map); %>
<c:forEach2 var="str" items="${map}">${str.key}-----${str.value}<br/></c:forEach2>

<% String[] strs = {"aa","bb","cc"}; request.setAttribute("strs", strs); %>
<c:forEach2 var="str" items="${strs}">${str}<br></c:forEach2>

HTML 轉義標籤（防 XSS）

處理類 HTMLFilter

public class HTMLFilter extends SimpleTagSupport {
    @Override
    public void doTag() throws JspException, IOException {
        JspFragment jf = this.getJspBody();
        StringWriter sw = new StringWriter();
        jf.invoke(sw); // 捕獲主體內容
        String s = filter(sw.toString()); // 轉義
        this.getJspContext().getOut().write(s);
    }

    private String filter(String msg) {
        if (msg == null) return null;
        char[] c = msg.toCharArray();
        StringBuffer sb = new StringBuffer(c.length + 50);
        for (char ch : c) {
            switch (ch) {
                case '<': sb.append("<"); break;
                case '>': sb.append(">"); break;
                case '&': sb.append("&"); break;
                case '"': sb.append("""); break;
                default: sb.append(ch);
            }
        }
        return sb.toString();
    }
}

TLD 定義

<tag>
    <name>htmlFilter</name>
    <tag-class>com.csdn.items.HTMLFilter</tag-class>
    <body-content>scriptless</body-content>
</tag>

JSP 使用

<c:htmlFilter><a href=""> aaa</a></c:htmlFilter>

輸出原始 HTML 文字而非被瀏覽器解析，有效防範 XSS。