http://localhost:8080/PAYSWeb/faces/protected/ticketDetail.xhtml?ticketId=1234354

http://localhost:8080/PAYSWeb/faces/protected/ticketDetail.xhtml?ticketId=AFGSUF?3D

package tr.com.provus.pays.wfilter.security;

import java.io.IOException;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import tr.com.provus.common.jsf.JSFUtil;
import tr.com.provus.common.util.StringEncrypter;
import tr.com.provus.common.util.StringUtils;
import tr.com.provus.pays.web.PAYSSession;

public class CustomFilter implements Filter {

	static class FilteredRequest extends HttpServletRequestWrapper {

		public FilteredRequest(ServletRequest request) {
			super((HttpServletRequest) request);

			String desKey = (String) ((HttpServletRequest) request).getSession().getAttribute(PAYSSession.DES_ENCRYPTION_KEY);
			if (StringUtils.isEmpty(desKey)) {
				desKey = StringEncrypter.DEFAULT_SESSION_KEY;
			}

			for (Map.Entry<String, String[]> entry : getParameterMap().entrySet()) {
				String key = entry.getKey();
				String[] value = entry.getValue();

				for (String param : FilteredParameters.parametersToBeEncrypted) {
					if (param.equals(key)) {
						for (int i = 0; i < value.length; i++) {
							String string = value[i];
							value[i] = encrypt(string, desKey);
						}
					}
				}
			}
		}

		public String decrypt(String input, String desKey) {
			// gelen parametre açılacak.
			String result = JSFUtil.getIndirectReferansDecryptValue(input, desKey);

			return result;
		}

		public String encrypt(String input, String desKey) {
			// gelen parametre açılacak.
			String result = JSFUtil.getIndirectReferansEncryptedValue(input, desKey);

			return result;
		}

		@Override
		public String getParameter(String paramName) {
			String desKey = PAYSSession.getDesEncryptionKey();
			if (StringUtils.isEmpty(desKey)) {
				desKey = StringEncrypter.DEFAULT_SESSION_KEY;
			}

			String[] strings = (String[]) getParameterMap().get(paramName);
			if (strings != null) {
				for (String encParamName : FilteredParameters.parametersToBeEncrypted) {
					if (paramName.trim().equals(encParamName.trim())) {
						return decrypt(strings[0], desKey);
					}
				}
			}

			return super.getParameter(paramName);
		}

		@Override
		public String[] getParameterValues(String paramName) {
			String desKey = PAYSSession.getDesEncryptionKey();
			if (StringUtils.isEmpty(desKey)) {
				desKey = StringEncrypter.DEFAULT_SESSION_KEY;
			}

			String values[] = super.getParameterValues(paramName);

			for (String encParamName : FilteredParameters.parametersToBeEncrypted) {
				if (paramName.trim().equals(encParamName.trim())) {
					for (int index = 0; index < values.length; index++) {
						values[index] = decrypt(values[index], desKey);
					}
				}
			}

			return values;
		}

		@Override
		public Map<String, String[]> getParameterMap() {
			return super.getParameterMap();
		}
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		chain.doFilter(new FilteredRequest(request), response);
	}

	@Override
	public void destroy() {
	}

	@Override
	public void init(FilterConfig filterConfig) {
	}
}