add permittedIp parameter for StatViewServlet

src/main/java/com/alibaba/druid/support/http/StatViewServlet.java

@@ -1,5 +1,8 @@
 package com.alibaba.druid.support.http;
 
+import com.alibaba.druid.util.IpUtils;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.io.IOException;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
@@ -40,12 +43,30 @@ public class StatViewServlet extends HttpServlet {
     public String                         templatePage;
     private static DateFormat format = new SimpleDateFormat("yyyy/MM/dd hh:mm:ss:SSS");
 
+    private String                        permittedIp;
+    private Pattern                       ipCheckPattern;
+
     public void init() throws ServletException {
         try {
             templatePage = IOUtils.readFromResource(TEMPLATE_PAGE_RESOURCE_PATH);
+            
         } catch (IOException e) {
             throw new ServletException("error read templatePage:" + TEMPLATE_PAGE_RESOURCE_PATH, e);
         }
+        permittedIp = getServletConfig().getInitParameter("permittedIp");
+        if (permittedIp != null ) {
+            this.ipCheckPattern = IpUtils.buildIpCheckPattern(permittedIp);
+        }
+    }
+
+    private boolean isPermittedRequest(HttpServletRequest request) {
+        //if nothing is configured, every host can access the stat result(default)
+        if (permittedIp == null || permittedIp.trim().equals("")) {
+            return true;
+        }
+        String remoteIp = request.getRemoteAddr();
+        Matcher matcher =  ipCheckPattern.matcher(remoteIp);
+        return matcher.matches();
     }
 
     public void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
@@ -55,11 +76,19 @@ public class StatViewServlet extends HttpServlet {
 
         response.setCharacterEncoding("utf-8");
 
+        
+
         if (contextPath == null) { // root context
             contextPath = "";
         }
         String uri = contextPath + servletPath;
         String path = requestURI.substring(contextPath.length() + servletPath.length());
+
+        if (!isPermittedRequest(request)) {
+            path = "/nopermit.html";
+            returnResourceFile(path, uri, response);
+            return;
+        }
         
         if ("".equals(path)) {
             if (contextPath == null || contextPath.equals("") || contextPath.equals("/")) {

src/main/java/com/alibaba/druid/util/IpUtils.java

@@ -0,0 +1,18 @@
+package com.alibaba.druid.util;
+
+import java.util.regex.Pattern;
+
+public class IpUtils {
+
+    public static Pattern buildIpCheckPattern(String permittedIP) {
+        String[] addrs = permittedIP.split(",");
+        StringBuilder sb = new StringBuilder();
+        for (String addr : addrs ) {
+            addr = addr.trim();
+            addr = addr.replace("*", "\\d{1,3}");
+            sb.append(addr.trim()).append("|");
+        }
+        return Pattern.compile(sb.toString());
+    }
+
+}

src/main/resources/support/http/resources/nopermit.html

@@ -0,0 +1,14 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title></title>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf8" />
+    <link href="css/style.css" type="text/css" rel="stylesheet"/>
+  </head>
+  <body >
+    <br/>
+    <div id="main">
+      <h2>Sorry, you are not permitted to view this page.</h2>
+    </div>
+  </body>
+</html>

src/test/java/com/alibaba/druid/util/IpUtilsTest.java

@@ -0,0 +1,47 @@
+package com.alibaba.druid.util;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.junit.Test;
+import org.junit.Assert;
+
+
+public class IpUtilsTest {
+
+
+    @Test
+    public void testBuildIpCheckPattern() {
+
+        Pattern pat = IpUtils.buildIpCheckPattern("192.168.0.*");
+        String[] validIps = {"192.168.0.1", "192.168.0.2","192.168.0.15","192.168.0.250"};
+        String[] inValidIps = {"192.168.15.1", "192.168.7.1","10.8.9.25","168.2.3.10"};
+        checkIp(pat, validIps, inValidIps);
+
+        pat = IpUtils.buildIpCheckPattern("192.168.0.1");
+        validIps = new String[] {"192.168.0.1"};
+        inValidIps = new String[] {"192.168.0.2", "192.168.1.0","10.15.255.3"};
+        checkIp(pat, validIps, inValidIps);
+
+        pat = IpUtils.buildIpCheckPattern("192.168.0.1,192.168.0.2,192.168.1.*");
+        validIps = new String[] {"192.168.0.1","192.168.0.2","192.168.1.15"};
+        inValidIps = new String[] {"192.168.0.3", "192.168.10.2","10.15.255.3","16.8.155.3"};
+        checkIp(pat, validIps, inValidIps);
+
+        
+    }
+
+    private void  checkIp(Pattern pat, String[] validIps, String[] inValidIps) {
+        Matcher matcher = null;
+        for (String validIp : validIps) {
+            matcher = pat.matcher(validIp);
+            Assert.assertTrue(matcher.matches());
+        }
+
+        for (String inValidIp : inValidIps) {
+            matcher = pat.matcher(inValidIp);
+            Assert.assertFalse(matcher.matches());
+        }
+    }
+
+}