Improved workaround for struts exploit

gistfile1.java

public class ParamFilter implements Filter {

	private Pattern pattern;


	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
		pattern = Pattern.compile(filterConfig.getInitParameter("excludeParams"));
	}


	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		chain.doFilter(new ParamFilteredRequest(request, pattern), response);
	}


	@Override
	public void destroy() {
	}

	/** */
	private static class ParamFilteredRequest extends HttpServletRequestWrapper {

		private final Pattern pattern;


		public ParamFilteredRequest(ServletRequest request, Pattern pattern) {
			super((HttpServletRequest)request);
			this.pattern = pattern;
		}


		@Override
		public Enumeration<String> getParameterNames() {
			List<String> requestParameterNames = Collections.list(super.getParameterNames());
			List<String> finalParameterNames = new ArrayList<>();

			for (String parameterName: requestParameterNames) {
				if (!pattern.matcher(parameterName).matches()) {
					finalParameterNames.add(parameterName);
				}
			}
			return Collections.enumeration(finalParameterNames);
		}
	}
}