From 94900c9430ba73f2a74735cff17da3081ec2e51b Mon Sep 17 00:00:00 2001
From: wangzhijiang <1358525938@qq.com>
Date: Fri, 8 Mar 2024 18:57:41 +0800
Subject: [PATCH] =?UTF-8?q?82580-=E5=AF=BC=E5=85=A5=E6=96=87=E6=A1=A3?=
 =?UTF-8?q?=E6=8B=86=E5=88=86=E8=AF=A6=E6=83=85=E4=BF=AE=E6=94=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../jero/modules/split/common/FileUnZip.java  | 37 ++++++++++++
 .../impl/FileSplitItemsEOServiceImpl.java     | 56 +++++++++++--------
 2 files changed, 69 insertions(+), 24 deletions(-)

diff --git a/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java b/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
index b6f8b66..63e1589 100644
--- a/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
+++ b/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
@@ -300,4 +300,41 @@ public class FileUnZip {
         return resultlist;
     }
 
+    /**
+     * 验证文件白名单
+     * @param path
+     * @param suffixs
+     * @return
+     */
+    public static boolean checkFileWhitelist(String path,String suffixs) {
+        boolean result = true;
+
+        String[] suffixArr = suffixs.split(",");
+        File file = new File(path);
+
+        if (file.isDirectory()) {
+            File[] files = file.listFiles();
+            // 对文件进行过滤
+            for (File fi : files) {
+                String name = fi.getName();
+
+                int lastIndexOfDot = name.lastIndexOf('.');
+
+                String fileSuffix = name.substring(lastIndexOfDot);
+
+                boolean flag = false;
+                for (String suffix : suffixArr) {
+                    if (fileSuffix.equals(suffix)) {
+                        flag = true;
+                        break;
+                    }
+                }
+                if (!flag) {
+                    result = flag;
+                    break;
+                }
+            }
+        }
+        return result;
+    }
 }
diff --git a/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java b/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
index f69cee0..81489fc 100644
--- a/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
+++ b/byd-structuredplugins-serve/laws-modules/src/main/java/com/jero/modules/split/service/impl/FileSplitItemsEOServiceImpl.java
@@ -1543,32 +1543,40 @@ public class FileSplitItemsEOServiceImpl extends ServiceImpl<FileSplitItemsEOMap
             saveDirectory.mkdir();
         }
         FileUtils.copyInputStreamToFile(file.getInputStream(), new File(path +File.separator+ file.getOriginalFilename()));
-        try{
-            //解压缩
-            String zipEntryName = FileUnZip.unZipFiles2(path +File.separator+ file.getOriginalFilename(), path);
-            // 数据相关处理,
-            // 1.获取其中的Excel,
-            List<File> excelfilelist = FileUnZip.readExcelFile(zipEntryName);
-            if(excelfilelist.size()<1){
-                //删除原上传文件
-                FileUnZip.deleteDir(saveDirectory);
-                if(MessageUtils.getLanguage().getValue().equals(LanguageEnum.CN.getValue())){
-                    resultMsg = "压缩包内没有上传Excel数据";
-                }else{
-                    resultMsg = "In the cabinet did not upload the Excel data";
-                }
-                return Result.error(1, resultMsg);
 
-            } else if (excelfilelist.size()>1) {
-                //删除原上传文件
-                FileUnZip.deleteDir(saveDirectory);
-                if(MessageUtils.getLanguage().getValue().equals(LanguageEnum.CN.getValue())){
-                    resultMsg = "压缩包根目录下仅能存在一个excel为导入数据";
-                }else{
-                    resultMsg = "Only one Excel file can be imported in the compressed package root directory";
-                }
-                return Result.error(1, resultMsg);
+        //解压缩
+        String zipEntryName = FileUnZip.unZipFiles2(path +File.separator+ file.getOriginalFilename(), path);
+        // 数据相关处理,
+        // 1.获取其中的Excel,
+        List<File> excelfilelist = FileUnZip.readExcelFile(zipEntryName);
+        if(excelfilelist.size()<1){
+            //删除原上传文件
+            FileUnZip.deleteDir(saveDirectory);
+            if(MessageUtils.getLanguage().getValue().equals(LanguageEnum.CN.getValue())){
+                resultMsg = "压缩包内没有上传Excel数据";
+            }else{
+                resultMsg = "In the cabinet did not upload the Excel data";
             }
+            return Result.error(1, resultMsg);
+
+        } else if (excelfilelist.size()>1) {
+            //删除原上传文件
+            FileUnZip.deleteDir(saveDirectory);
+            if(MessageUtils.getLanguage().getValue().equals(LanguageEnum.CN.getValue())){
+                resultMsg = "压缩包根目录下仅能存在一个excel为导入数据";
+            }else{
+                resultMsg = "Only one Excel file can be imported in the compressed package root directory";
+            }
+            return Result.error(1, resultMsg);
+        }
+        String suffixs = ".xls,.xlsx,.jpg,.jpeg,.png,.gif";
+        boolean checkFileWhitelistFlag = FileUnZip.checkFileWhitelist(zipEntryName, suffixs);
+        if (!checkFileWhitelistFlag) {
+            throw new JeroBootException("导入的文件中包含不合法文件，图片只能上传 .jpg、.jpeg、.png、.gif 格式");
+        }
+
+        try{
+
             File excelfile = excelfilelist.get(0);
 
             try {