title: Modify request parameter with servlet filter
body: <p>An existing web application is running on Tomcat 4.1.  There is an XSS issue with a page, but I can't modify the source.  I've decided to write a servlet filter to sanitize the parameter before it is seen by the page.</p>
  
  <p>I would like to write a Filter class like this:</p>
  
  <pre><code>import java.io.*;
  import javax.servlet.*;
  
  public final class XssFilter implements Filter {
  
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException
    {
      String badValue = request.getParameter("dangerousParamName");
      String goodValue = sanitize(badValue);
      request.setParameter("dangerousParamName", goodValue);
      chain.doFilter(request, response);
    }
  
    public void destroy() {
    }
  
    public void init(FilterConfig filterConfig) {
    }
  }
  </code></pre>
  
  <p>But <code>ServletRequest.setParameter</code> doesn't exist.</p>
  
  <p>How can I change the value of the request parameter before passing the request down the chain?</p>