{"id":43,"date":"2026-01-20T23:51:34","date_gmt":"2026-01-20T15:51:34","guid":{"rendered":"http:\/\/byname6.cn\/?p=43"},"modified":"2026-03-01T02:37:52","modified_gmt":"2026-02-28T18:37:52","slug":"jsf%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%961-mojarra","status":"publish","type":"post","link":"http:\/\/byname6.cn\/index.php\/2026\/01\/20\/jsf%e5%8f%8d%e5%ba%8f%e5%88%97%e5%8c%961-mojarra\/","title":{"rendered":"JSF\u53cd\u5e8f\u5217\u5316\u4e00\u2014Mojarra"},"content":{"rendered":"\n

\u6700\u8fd1\u6316\u6d1e\u9047\u5230\u4e00\u4e9bJSF\u7684\u73af\u5883\uff0c\u987a\u5e26\u7740\u7092\u7092\u51b7\u996d\uff0c\u5b66\u4e60\u4e00\u4e0bJSF\u6846\u67b6\u7684\u6f0f\u6d1e\u3002<\/p>\n\n\n\n

JSF<\/h1>\n\n\n\n

JavaServer Faces\uff08JSF\uff09\u662f\u4e00\u4e2a\u7528\u4e8e\u6784\u5efa\u7528\u6237\u754c\u9762\u7684 Java \u6846\u67b6\uff0c\u4f7f\u5f00\u53d1\u8005\u80fd\u591f\u5feb\u901f\u521b\u5efa\u52a8\u6001\u3001\u4ea4\u4e92\u5f0f\u7684\u7528\u6237\u754c\u9762\u3002\u4e00\u822c\u7684\u8def\u7531\u540e\u7f00\u4e3a.xhtml\uff08\u9ed8\u8ba4\uff09\u3001.jsf\u3002<\/p>\n\n\n\n

\u76ee\u524d\u4e3b\u6d41\u7684JSF\u6846\u67b6\u5206\u4e3a\u4e24\u4e2a\uff1a<\/p>\n\n\n\n

EE4J\u7ef4\u62a4\u7684Mojarra<\/p>\n\n\n\n

       
        <dependency>
            <groupId>org.glassfish<\/groupId>
            <artifactId>javax.faces<\/artifactId>
            <version>2.2.20<\/version>
        <\/dependency>

        <dependency>
            <groupId>javax.el<\/groupId>
            <artifactId>javax.el-api<\/artifactId>
            <version>3.0.0<\/version>
            <scope>provided<\/scope>
        <\/dependency>
<\/pre>\n\n\n\n
Apache\u7ef4\u62a4\u7684MyFaces<\/p>\n\n\n\n
 \u00a0 \u00a0<dependency>
 \u00a0 \u00a0 \u00a0<groupId>org.apache.myfaces.core<\/groupId>
 \u00a0 \u00a0 \u00a0<artifactId>myfaces-api<\/artifactId>
 \u00a0 \u00a0 \u00a0<version>x<\/version> 
 \u00a0 \u00a0<\/dependency>
 \u00a0 \u00a0<dependency>
 \u00a0 \u00a0 \u00a0<groupId>org.apache.myfaces.core<\/groupId>
 \u00a0 \u00a0 \u00a0<artifactId>myfaces-impl<\/artifactId> \u00a0 \u00a0  \/\/\u4f9d\u8d56CC ^^ 
 \u00a0 \u00a0 \u00a0<version>x<\/version> \u00a0
 \u00a0 \u00a0<\/dependency>
<\/pre>\n\n\n\n
\u8fd9\u91ccMyFaces\u5305\u91cc\u540c\u6837\u5b9e\u73b0\u4e86\u4f5c\u4e3aJSF\u89c4\u8303\u7684javax.faces\uff0cMyfaces\u548cMojarra\u90fd\u540c\u6837\u7528javax.faces\u5305\u4e0b\u7684FacesServlet\u4f5c\u4e3aservlet\u3002<\/strong><\/p>\n\n\n\n
JSF\u4e0d\u60f3\u5c40\u9650\u4e8eHTTP\u65e0\u72b6\u6001\u5e26\u6765\u7684\u95ee\u9898\uff0c\u5176\u89e3\u51b3\u95ee\u9898\u7684\u65b9\u6cd5\u662f\u72b6\u6001\u5316\u7684\u7ec4\u4ef6\u6a21\u578b<\/strong>\u3002<\/p>\n\n\n\n
\u5b83\u4eceNET\u5e94\u7528\u5f15\u5165\u4e86ViewState\u673a\u5236\uff0c\u7528\u4e8e\u5b58\u50a8JSF\u7ec4\u4ef6\u7684\u72b6\u6001\uff1b\u5176\u4f53\u73b0\u4e3a\u7ec4\u4ef6\u72b6\u6001\u7684\u5e8f\u5217\u5316\u6d41\uff0c\u7528\u6237\u8bf7\u6c42\u65f6\u4f1a\u643a\u5e26\u9644\u5e26\u5728\u8868\u5355\u91cc\u7684ViewState\u6216\u8005\u670d\u52a1\u7aefViewState\u5bf9\u5e94\u7684\u5f15\u7528\u6807\u8bc6(\u53d6\u51b3\u4e8eViewState\u7684\u5b58\u50a8\u6a21\u5f0f)\uff0c\u670d\u52a1\u7aef\u53d6viewState\u53cd\u5e8f\u5217\u5316\u3002<\/p>\n\n\n\n
\u5173\u4e8eViewState\u7684\u5b58\u50a8\u6709\u4e24\u4e2a\u5173\u952e\u7ec6\u8282\uff1a<\/p>\n\n\n\n
1.\u5b58\u50a8\u4f4d\u7f6e \u5ba2\u6237\u7aef OR \u670d\u52a1\u7aef<\/strong><\/p>\n\n\n\n
\u4e24\u4e2a\u6846\u67b6\u90fd\u662f\u9ed8\u8ba4\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\uff0c\u9700\u8981\u914d\u7f6eweb.xml\u8fdb\u884c\u4fee\u6539\u3002<\/p>\n\n\n\n
\u5b58\u50a8\u5728\u670d\u52a1\u7aef\u4f1a\u5927\u91cf\u52a0\u5267\u670d\u52a1\u7aef\u8d1f\u8f7d\uff0c\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\u4f1a\u589e\u52a0\u7f51\u7edc\u8bf7\u6c42\u7684\u8f7d\u8377\u3002<\/p>\n\n\n\n
Mojarra\u5728\u670d\u52a1\u7aef\u5b58\u50a8viewState\u7684\u60c5\u51b5\u4e0b\u53ea\u4f1a\u643a\u5e26\u5bf9\u5e94viewState\u7684\u5f15\u7528\u6807\u8bc6\uff0c\u7c7b\u4f3c\u4e8esession\uff0c\u4e0d\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\uff1b<\/p>\n\n\n\n
MyFaces\u4e5f\u662f\u5982\u6b64\u3002<\/p>\n\n\n\n
2.\u52a0\u5bc6 OR \u4e0d\u52a0\u5bc6<\/strong><\/p>\n\n\n\n
Mojarra 2.1.29-08\u30012.0.11-04\u9ed8\u8ba4\u4e0d\u52a0\u5bc6<\/p>\n\n\n\n
MyFaces\u7248\u672c1.1.7\u30011.2.8\u30012.0\u548c\u66f4\u65e9\u7248\u672c<\/p>\n\n\n\n
\u8fd9\u7bc7\u5148\u5b66\u4e60Mojarra\u6846\u67b6\u4e0b\u7684ViewState\u53cd\u5e8f\u5217\u5316<\/p>\n\n\n\n
\u6e90\u7801\u6d41\u7a0b<\/h1>\n\n\n\n
\u73af\u5883\u642d\u5efa<\/h2>\n\n\n\n
\u4ee5TOMACT\u4e3a\u5bb9\u5668\uff0c\u4f9d\u8d56\u5982\u4e0b\uff1a<\/p>\n\n\n\n
<dependency>
    <groupId>org.glassfish<\/groupId>
    <artifactId>javax.faces<\/artifactId>
    <version>2.2.20<\/version>
<\/dependency>
\u200b
<dependency>
    <groupId>javax.el<\/groupId>
    <artifactId>javax.el-api<\/artifactId>
    <version>3.0.0<\/version>
    <scope>provided<\/scope>
<\/dependency><\/pre>\n\n\n\n
\u5176\u4e2dEL\u5305\u662f\u5e7f\u6cdb\u5e94\u7528\u4e8exhtml\u4e2d\u7684\u8bed\u6cd5\uff0c\u793a\u4f8btest.xhtml\uff1a<\/p>\n\n\n\n
<!DOCTYPE html>
<html xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\"
      xmlns:h=\"http:\/\/xmlns.jcp.org\/jsf\/html\">
<h:head>
    <title>\u7b80\u5355\u8868\u5355\u6d4b\u8bd5<\/title>
<\/h:head>
<h:body>
    <h2>\u6700\u7b80\u5355\u7684\u8868\u5355\u7ed1\u5b9a<\/h2>
    <!-- \u8868\u5355 -->
    <h:form>
        <!-- \u8f93\u5165\u6846 - \u7ed1\u5b9a\u5230Bean -->
        \u59d3\u540d: <h:inputText value=\"#{testBean.name}\"\/>
        <br\/><br\/>
        <!-- \u63d0\u4ea4\u6309\u94ae -->
        <h:commandButton value=\"\u63d0\u4ea4\" action=\"#{testBean.submit}\"\/>
    <\/h:form>
    <hr\/>
    <!-- \u663e\u793a\u7ed3\u679c - \u4eceBean\u83b7\u53d6\u503c -->
    <h3>\u4f60\u8f93\u5165\u7684\u662f: #{testBean.name}<\/h3>
<\/h:body>
<\/html><\/pre>\n\n\n\n
\u6e90\u7801\u5206\u6790<\/h2>\n\n\n\n
\u5927\u81f4\u6d41\u7a0b<\/h3>\n\n\n\n
Mojarra\u5904\u7406\u8bf7\u6c42\u8c03\u7528\u7684Servlet\u662fJSF\u89c4\u8303javax.faces<\/code><\/strong>\u5305\u4e0b\u7684\uff1a<\/p>\n\n\n\n
javax.faces.webapp.FacesServlet<\/code><\/strong>\u3002<\/p>\n\n\n\n
\u5176Service\u65b9\u6cd5\u4f1a\u8fdb\u884c\u4e00\u7cfb\u5217\u5224\u65ad\u548c\u5bf9\u8c61\u83b7\u53d6\uff0c\u5982\uff1a<\/p>\n\n\n\n
\"image-20260115232306163\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u8c03\u7528JSF\u7684\u751f\u547d\u5468\u671f\u7ba1\u7406\u5668\uff1a<\/p>\n\n\n\n
\"image-20260115232547945\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91ccLifecycle\u5c31\u662f\u7528\u7684Mojarra\u81ea\u5df1\u5b9e\u73b0\u7684\u7c7b\u4e86com.sun.faces.lifecycle.LifecycleImpl<\/p>\n\n\n\n
Lifecycle#attachWindow()<\/code><\/strong> \u65b9\u6cd5\u786e\u4fdd\u6bcf\u4e2aHTTP\u8bf7\u6c42\u90fd\u5173\u8054\u4e00\u4e2a\u552f\u4e00\u7684ClientWindow<\/code>\u5b9e\u4f8b\uff0c\u7528\u4e8e\u5b9e\u73b0\u6d4f\u89c8\u5668\u591a\u6807\u7b7e\u9875\u95f4\u7684\u72b6\u6001\u9694\u79bb\u3002ClientWindow<\/code>\u662fJSF 2.2\u5f15\u5165\u7684\u673a\u5236\uff0c\u901a\u8fc7\u5728URL\u6216\u5ba2\u6237\u7aef\u5b58\u50a8\u4e2d\u7ef4\u62a4\u7a97\u53e3\u6807\u8bc6\u7b26\uff0c\u6765\u89e3\u51b3HTTP\u65e0\u72b6\u6001\u534f\u8bae\u4e0b\u7684\u591a\u7a97\u53e3\u72b6\u6001\u7ba1\u7406\u95ee\u9898\u3002\u8be5\u529f\u80fd\u9ed8\u8ba4\u5173\u95ed<\/strong>\uff0c\u9700\u8981\u901a\u8fc7\u914d\u7f6e\u53c2\u6570javax.faces.CLIENT_WINDOW_MODE<\/code><\/strong>\u663e\u5f0f\u542f\u7528\u3002\u8fd9\u91cc\u548c\u6211\u4eec\u7814\u7a76\u4e4b\u7269\u4e0d\u5927\u76f8\u5173\uff0c\u4e5f\u4e0d\u518d\u8d58\u8ff0\u3002<\/p>\n\n\n\n
Lifecycle#execute()<\/code><\/strong>\u548cLifecycle#render()<\/code><\/strong>\u662fJSF\u6846\u67b6\u7684\u6838\u5fc3\u6d41\u7a0b\u8c03\u7528\uff0c\u5728\u8c03\u8bd5\uff0c\u6700\u597d\u5148\u660e\u786eJSF\u7684\u6e32\u67d3\u6d41\u7a0b\uff0c\u5206\u4e3a\u8fd9\u516d\u4e2a\u9636\u6bb5\uff1a<\/p>\n\n\n\n
    \n
  1. \u6062\u590d\u89c6\u56fe\uff08Restore View\uff09\uff1a\u6784\u5efa\u6216\u6062\u590dUI\u7ec4\u4ef6\u6811\u3002<\/li>\n\n\n\n
  2. \u5e94\u7528\u8bf7\u6c42\u503c\uff08Apply Request Values\uff09\uff1a\u5c06\u8bf7\u6c42\u4e2d\u7684\u503c\u66f4\u65b0\u5230UI\u7ec4\u4ef6\u3002<\/li>\n\n\n\n
  3. \u5904\u7406\u9a8c\u8bc1\uff08Process Validations\uff09\uff1a\u6267\u884c\u8f93\u5165\u9a8c\u8bc1\u3002<\/li>\n\n\n\n
  4. \u66f4\u65b0\u6a21\u578b\u503c\uff08Update Model Values\uff09\uff1a\u5c06UI\u7ec4\u4ef6\u7684\u503c\u66f4\u65b0\u5230\u540e\u53f0Bean\u3002<\/li>\n\n\n\n
  5. \u8c03\u7528\u5e94\u7528\uff08Invoke Application\uff09\uff1a\u6267\u884c\u4e1a\u52a1\u903b\u8f91\u3002<\/li>\n\n\n\n
  6. \u6e32\u67d3\u54cd\u5e94\uff08Render Response\uff09\uff1a\u5c06UI\u7ec4\u4ef6\u6811\u6e32\u67d3\u4e3aHTML\u8f93\u51fa\u3002<\/li>\n<\/ol>\n\n\n\n
    \u5728\u4ee3\u7801\u4e2d\uff0c\u6bcf\u4e00\u4e2a\u9636\u6bb5\u5bf9\u5e94\u8fd9\u4e00\u4e2a\u4e0d\u540c\u7684com.sun.faces.lifecycle.Phase<\/code><\/strong><\/p>\n\n\n\n
    \"image-20260115235522983\"\/<\/div><\/figure>\n\n\n\n
    Lifecycle#execute()<\/code><\/strong>\u662f\u5bf9\u524d\u4e94\u4e2a\u9636\u6bb5\u5bf9\u5e94Phase\u8fdb\u884c\u8c03\u7528\uff1a<\/p>\n\n\n\n
    LifecycleImpl#execute<\/code>\uff1a<\/p>\n\n\n\n
    \"image-20260115235846107\"\/<\/div><\/figure>\n\n\n\n
    \u800cLifecycle#render()<\/code><\/strong>\u662f\u5355\u72ec\u5bf9\u6700\u540e\u4e00\u6b65\u6e32\u67d3\u89c6\u56fe\u7684Phase\u8c03\u7528\uff1a<\/p>\n\n\n\n
    LifecycleImpl#render()<\/code><\/p>\n\n\n\n
    \"image-20260116000036545\"\/<\/div><\/figure>\n\n\n\n
    Phase#doPhase<\/code>\u7684\u5927\u81f4\u6d41\u7a0b\uff1a<\/p>\n\n\n\n
    ......
    \/\/\u8fdb\u884cFlash\u7684\u9884\u5904\u7406\u548c\u6ce8\u518c\u76d1\u542c\u5668\u7684beforePhase
    handleBeforePhase(context, listeners, event);
    \u200b
    \/\/\u8c03\u7528Phase\u5177\u4f53\u5b9e\u73b0\u7c7b\u5bf9\u5e94\u7684\u65b9\u6cd5
    execute(context);
    \u200b
    \/\/\u8c03\u7528Flash\u7684\u6e05\u7406\u548c\u6309\u76f8\u53cd\u987a\u5e8f\u8c03\u7528\u6ce8\u518c\u76d1\u542c\u5668\u7684afterPhase
    handleAfterPhase(context, listeners, event);<\/pre>\n\n\n\n
    Flash\u662fJSF 2.0+\u5f15\u5165\u7684\u4e00\u79cd\u7279\u6b8a\u4f5c\u7528\u57df\uff0c\u7528\u4e8e\u5728\u91cd\u5b9a\u5411\uff08redirect\uff09\u8bf7\u6c42\u95f4\u4e34\u65f6\u5b58\u50a8\u6570\u636e\uff0c\u6570\u636e\u5728\u4e0b\u4e00\u4e2a\u8bf7\u6c42\u540e\u88ab\u81ea\u52a8\u6e05\u9664\u3002<\/p>\n\n\n\n
    viewState\u53cd\u5e8f\u5217\u5316<\/h3>\n\n\n\n
    \u5927\u81f4\u7684JSF\u6267\u884c\u7ed3\u6784\u5c31\u662f\u8fd9\u6837\uff0c\u56de\u5230\u5bf9viewState\u7684\u5904\u7406\u4e0a\uff0c\u5728\u6062\u590d\u89c6\u56fe\uff08Restore View\uff09\u9636\u6bb5\uff0c\u5c31\u5b58\u5728viewState\u7684\u53cd\u5e8f\u5217\u5316\u903b\u8f91\u4e86\u3002<\/p>\n\n\n\n
    \u8fd9\u91cc\u6211\u628a\u4ee3\u7801\u7b80\u5316\u4e00\u4e0b\uff0c\u5c06\u6838\u5fc3\u4ee3\u7801\u63d0\u51fa\u6765<\/p>\n\n\n\n
    com.sun.faces.lifecycle.RestoreViewPhase#execute()<\/code>\uff1a<\/p>\n\n\n\n
    ......
    boolean isPostBack = facesContext.isPostback();
    \u200b
    if (isPostBack) {
       
        ......
        
        viewRoot = viewHandler.restoreView(facesContext, viewId); \/\/ViewState\u53cd\u5e8f\u5217\u5316\u70b9
        
        ......
        
    } else {  \/\/\u4e0d\u8fdb\u884cViewState\u53cd\u5e8f\u5217\u5316
     
            if (metadata != null) {
                viewRoot = metadata.createMetadataView(facesContext);
            }
        
        if (viewRoot == null) {
            viewRoot = viewHandler.createView(facesContext, viewId);
        }
        
        facesContext.setViewRoot(viewRoot);
        facesContext.renderResponse(); \/\/ \u544a\u8bc9JSF\uff1a\u53ea\u9700\u6e32\u67d3\uff0c\u65e0\u9700\u6267\u884c\u540e\u7eed\u9636\u6bb5
    }
    ......<\/pre>\n\n\n\n
    \u5f88\u6e05\u695a\uff0c\u51b3\u5b9a\u662f\u5426\u53cd\u5e8f\u5217\u5316viewState\u7684\u5173\u952e\u5728\u4e8eisPostBack\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u83b7\u53d6javax.faces.render.ResponseStateManager#isPostback()<\/code>\u7684\u6ce8\u91ca\u6765\u4e86\u89e3\u8fd9\u4e2a\u503c\u5230\u5e95\u610f\u5473\u7740\u4ec0\u4e48\uff1a<\/p>\n\n\n\n
    Return true if the current request is a postback. This method is leveraged from the Restore View Phase to determine if javax.faces.application.ViewHandler.restoreView or javax.faces.application.ViewHandler.createView should be called. The default implementation must return true if this ResponseStateManager instance wrote out state on a previous request to which this request is a postback, false otherwise. The implementation of this method for the Standard HTML RenderKit must consult the javax.faces.context.ExternalContext’s requestParameterMap and return true if and only if there is a key equal to the value of the symbolic constant VIEW_STATE_PARAM. For backwards compatability with implementations of ResponseStateManager prior to JSF 1.2, a default implementation is provided that consults the javax.faces.context.ExternalContext’s requestParameterMap and return true if its size is greater than 0.<\/em><\/p>\n\n\n\n
    \u7b80\u800c\u8a00\u4e4b\uff0cJSF\u5c06\u5df2\u7ecf\u8bf7\u6c42\u8fc7\u7684\u9875\u9762\u63d0\u4ea4\u8868\u5355\u7ed9\u81ea\u5df1\u5904\u7406\u7684\u8bf7\u6c42<\/strong>\u79f0\u4e3aPostBack\u3002\u5982\u679c\u5728\u6062\u590d\u89c6\u56fe\u7684\u9636\u6bb5\u4e2d\uff0c\u8bf7\u6c42\u4e0d\u662f\u4e00\u4e2aPostBack\uff0c\u5c31\u4f1a\u8c03\u7528ViewHandler#createView()<\/code><\/strong>\u521b\u5efa\u4e00\u4e2a\u89c6\u56fe\uff1b\u5982\u679c\u662fPostBack\uff0c\u5c31\u4f1a\u53bb\u901a\u8fc7ViewState\u5b57\u6bb5\u83b7\u53d6\u539f\u6765\u89c6\u56fe\u7684\u72b6\u6001\uff0c\u4ece\u800c\u6062\u590d\u89c6\u56fe\u3002<\/p>\n\n\n\n
    \u5f88\u7b80\u5355\u7684\u9053\u7406\uff0c\u8bf7\u6c42\u4e00\u4e2a\u5df2\u7ecf\u8bf7\u6c42\u8fc7(\u6709\u72b6\u6001)\u7684\u9875\u9762\uff0c\u5728\u6062\u590d\u89c6\u56fe\u9636\u6bb5\u81ea\u7136\u662f\u53d6\u5176viewState\u6062\u590d\u89c6\u56fe\u72b6\u6001\uff1b\u800c\u8bf7\u6c42\u4e00\u4e2a\u65b0\u7684\u9875\u9762(\u975ePostBack)\uff0c\u81ea\u7136\u5728\u8be5\u9636\u6bb5\u6240\u505a\u7684\u52a8\u4f5c\u662f\u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u89c6\u56fe\u3002\uff08AJAX\u4e5f\u53ef\u4ee5\u4f5c\u4e3aPostBack\uff09<\/p>\n\n\n\n
    \u660e\u786e\u4e86\u8fd9\u4e00\u70b9\u540e\uff0c\u6211\u4eec\u63a5\u7740\u53bb\u770bviewState\u7684\u53cd\u5e8f\u5217\u5316\u5b9e\u73b0\uff1a<\/p>\n\n\n\n
    com.sun.faces.application.view.MultiViewHandler#restoreView()<\/code><\/p>\n\n\n\n
    public UIViewRoot restoreView(FacesContext context, String viewId) {
    \u200b
        Util.notNull(\"context\", context);
        String actualViewId = derivePhysicalViewId(context, viewId, false);
        return vdlFactory.getViewDeclarationLanguage(actualViewId)
              .restoreView(context, actualViewId);
    }<\/pre>\n\n\n\n
    \u8fd9\u91cc\u4ecevdlFactory\u4e2d\u8fd4\u56de\u5e76\u6267\u884c\u7684\u662fcom.sun.faces.application.view.FaceletViewHandlingStrategy#restoreView()<\/code><\/strong><\/p>\n\n\n\n
    strategy\u6307\u7b56\u7565\u6a21\u5f0f\uff0c\u6bd4\u5982\u8fd9\u91cc\u53d1\u73b0\u6211\u4eec\u8bf7\u6c42\u7684\u662f\u4e00\u4e2ajsf\u76f8\u5173\u7684\u9875\u9762\uff0c\u8fd4\u56de\u7684\u5c31\u662f”Facelet\u89c6\u56fe\u5904\u7406\u7b56\u7565”\u3002<\/p>\n\n\n\n
    \"image-20260116004401296\"\/<\/div><\/figure>\n\n\n\n
    \u8be5\u65b9\u6cd5\u4f1a\u53bb\u8c03\u7528com.sun.faces.renderkit.ResponseStateManagerImpl#getState<\/code>\uff0c\u4e00\u770b\u5176\u5f3a\u8f6cObject\u7684\u64cd\u4f5c\u5c31\u5bb9\u6613\u731c\u6d4b\u8fd9\u91cc\u4fbf\u662f\u53cd\u5e8f\u5217\u5316\u70b9\u3002<\/p>\n\n\n\n
    \u6574\u4e2a\u53cd\u5e8f\u5217\u5316\u903b\u8f91\u5f88\u7b80\u5355\uff1a<\/p>\n\n\n\n
    \u8bfb\u53d6viewState\u5b57\u6bb5\uff0cbase64\u89e3\u7801\uff0c\u89e3\u5bc6(\u9ed8\u8ba4AES)\uff0creadLong\uff0creadObject<\/p>\n\n\n\n
    \"image-20260116004859054\"\/<\/div><\/figure>\n\n\n\n
    \u6211\u4eec\u53ef\u4ee5\u5173\u6ce8\u4e00\u4e0b\u79c1\u94a5\u751f\u6210\u7684\u5730\u65b9\uff1a<\/p>\n\n\n\n
    com.sun.faces.renderkit.ByteArrayGuard#setupKeyAndMac()<\/code><\/p>\n\n\n\n
     private void setupKeyAndMac() {
            try {
                InitialContext context = new InitialContext();
                String encodedKeyArray = (String) context.lookup(\"java:comp\/env\/jsf\/ClientSideSecretKey\");
                byte[] keyArray = DatatypeConverter.parseBase64Binary(encodedKeyArray);
                sk = new SecretKeySpec(keyArray, KEY_ALGORITHM);
            }
            catch(NamingException exception) {
                if (LOGGER.isLoggable(Level.FINEST)) { 
                    LOGGER.log(Level.FINEST, \"Unable to find the encoded key.\", exception);
                }
            }
            
            if (sk == null) {
                try {
                    KeyGenerator kg = KeyGenerator.getInstance(KEY_ALGORITHM);
                    kg.init(KEY_LENGTH);   \/\/ 256 if you're using the Unlimited Policy Files
                    sk = kg.generateKey(); 
    \/\/                System.out.print(\"SecretKey: \" + DatatypeConverter.printBase64Binary(sk.getEncoded()));
    \u200b
                } catch (Exception e) {
                    throw new FacesException(e);
                }
            }
        }<\/pre>\n\n\n\n
    \u5148\u8c03\u7528JNDI\u53bblookup java:comp\/env\/jsf\/ClientSideSecretKey<\/code><\/strong>\uff0c\u5982\u679c\u6ca1\u6709\u627e\u5230\uff0c\u624d\u4f1a\u5229\u7528\u968f\u673a\u6570\u521b\u5efa\u4e00\u4e2a\u3002<\/p>\n\n\n\n
    \u8fd9\u91cc\u7684java:comp\/env\/\u5c31\u662f\u6307\u7684\u5f53\u524d\u4e0a\u4e0b\u6587\u7684\u8d44\u6e90\u6c60\uff0c\u9ed8\u8ba4\u4f1a\u53bb\u5f53\u524dweb\u5e94\u7528\u7684web.xml<\/strong>\u4e2d\u627e<\/p>\n\n\n\n
    <web-app ...>
        ...
        <env-entry>
            <env-entry-name>jsf\/ClientSideSecretKey<\/env-entry-name>
            <env-entry-type>java.lang.String<\/env-entry-type>
            <env-entry-value>\u4f60\u7684\u5bc6\u94a5\u5b57\u7b26\u4e32<\/env-entry-value>
        <\/env-entry>
    <\/web-app><\/pre>\n\n\n\n
    \u6240\u4ee5\u5982\u679c\u76ee\u6807JSF\u7ad9\u70b9\u5982\u679c\u5b58\u5728\u4efb\u610f\u6587\u4ef6\u8bfb\uff0c\u53ef\u4ee5\u8bd5\u7740\u53bb\u67e5\u770bweb.xml\u91cc\u9762\u5f00\u53d1\u8005\u4f1a\u4e0d\u4f1a\u81ea\u5df1\u786c\u7f16\u7801\u4e86\u4e00\u4e2a\u79c1\u94a5\u4e32\u3002<\/p>\n\n\n\n
    \u6ce8\uff1aMojarra 1.2.x-2.0.3<\/strong>\u9ed8\u8ba4DES\u52a0\u5bc6\uff0cMojarra 2.0.4-\u81f3\u4eca<\/strong>\u9ed8\u8ba4AES\u52a0\u5bc6<\/p>\n\n\n\n
    viewState\u5b58\u50a8\u4f4d\u7f6e<\/h3>\n\n\n\n
    Mojarra\u662f\u9ed8\u8ba4\u5728\u670d\u52a1\u7aef\u5b58\u50a8viewState\u7684\uff0c\u9700\u8981\u5728web.xml\u4e2d\u52a0\u5165\u914d\u7f6e\u624d\u4f1a\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\uff1a<\/p>\n\n\n\n
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD<\/param-name>
        <param-value>client<\/param-value>
    <\/context-param><\/pre>\n\n\n\n
    \u5b58\u50a8\u5728\u670d\u52a1\u7aef\u4f1a\u5927\u91cf\u52a0\u5267\u670d\u52a1\u7aef\u8d1f\u8f7d\uff0c\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\u4f1a\u589e\u52a0\u7f51\u7edc\u8bf7\u6c42\u7684\u8f7d\u8377\u3002<\/p>\n\n\n\n
    \u5b58\u50a8\u5728\u5ba2\u6237\u7aef\uff1a<\/p>\n\n\n\n
    \"image-20260116123941804\"\/<\/div><\/figure>\n\n\n\n
    \u5b58\u50a8\u5728\u670d\u52a1\u7aef\uff1a<\/p>\n\n\n\n
    \"image-20260116124445254\"\/<\/div><\/figure>\n\n\n\n
    Mojarra\u4ec5\u4f1a\u5bf9\u5ba2\u6237\u7aef\u5b58\u50a8viewState\u7684\u60c5\u51b5\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c\u3002<\/p>\n\n\n\n
    \u94fe\u5b50<\/h1>\n\n\n\n
    \u7528codeql\u641c\u4e86\u4e00\u6ce2\uff0c\u6ca1\u6709JSF\u6846\u67b6\u4ee5\u53ca\u5176\u4f9d\u8d56\u539f\u751f\u7684sink\uff0c\u4e5f\u6ca1\u6709\u80fd\u63a5TemplateImpl getter\u7684readobject\u3002<\/p>\n\n\n\n
    \u6240\u4ee5\u5982\u679c\u670d\u52a1\u5668\u5355\u5355\u5c31\u4f7f\u7528\u4e86JSF\u73af\u5883\u7684\u8bdd\uff0c\u53ea\u6709\u53ef\u80fd\u6253JDK\u7684\u51e0\u6761\u539f\u751f\u53cd\u5e8f\u5217\u5316\u94fe\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
    \u6700\u8fd1\u6316\u6d1e\u9047\u5230\u4e00\u4e9bJSF\u7684\u73af\u5883\uff0c\u987a\u5e26\u7740\u7092\u7092\u51b7\u996d\uff0c\u5b66\u4e60\u4e00\u4e0bJSF\u6846\u67b6\u7684\u6f0f\u6d1e\u3002 JSF JavaServer Fac […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-43","post","type-post","status-publish","format-standard","hentry","category-java"],"_links":{"self":[{"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/posts\/43","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/comments?post=43"}],"version-history":[{"count":7,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/posts\/43\/revisions"}],"predecessor-version":[{"id":56,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/posts\/43\/revisions\/56"}],"wp:attachment":[{"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/media?parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/categories?post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/byname6.cn\/index.php\/wp-json\/wp\/v2\/tags?post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}