From 7eeb542b89bc8a34cfd6efc2fc9f7e2777773e6f Mon Sep 17 00:00:00 2001
From: mzc5649 <13027087095@163.com>
Date: Wed, 14 Apr 2021 11:36:29 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90add=E3=80=91=E4=B8=8A=E4=BC=A0?=
 =?UTF-8?q?=E6=96=87=E4=BB=B6=E7=B1=BB=E5=9E=8B=E7=9A=84=E9=BB=91=E5=90=8D?=
 =?UTF-8?q?=E5=8D=95=E9=99=90=E5=88=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/jero/common/util/CommonUtils.java    | 15 +++++++++++++++
 .../system/controller/CommonController.java       | 13 +++++++++++++
 .../src/main/resources/application-dev.yml        |  2 ++
 .../src/main/resources/application-prod.yml       |  2 ++
 4 files changed, 32 insertions(+)

diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java
index d9a67847..9c0967fa 100644
--- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java
+++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java
@@ -17,6 +17,8 @@ import java.io.InputStream;
 import java.sql.Connection;
 import java.sql.DatabaseMetaData;
 import java.sql.SQLException;
+import java.util.Arrays;
+import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -206,4 +208,17 @@ public class CommonUtils {
         return DB_TYPE;
 
     }
+    /**
+     * 黑名单限制文件
+     * @date 2021/4/14 6:18
+     * @param fileName 文件名
+     * @return boolean true：处于黑名单 false：不处于黑名单
+     */
+    public static boolean limitFileSuffix(String fileName,String[] fileSuffixLimits){
+        final List<String> fileNameList = Arrays.asList(fileSuffixLimits);
+        boolean isExists = fileNameList.stream().anyMatch(name -> fileName.substring(0,fileName.lastIndexOf('.')).contains(name)||fileName.substring(fileName.lastIndexOf('.')).equals(name));
+        return isExists;
+    }
+
+
 }
\ No newline at end of file
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java
index b99708a1..57b43b63 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java
@@ -57,6 +57,11 @@ public class CommonController {
      */
     @Value(value="${jero.uploadType}")
     private String uploadType;
+    /**
+     * 文件后缀黑名单
+     */
+    @Value(value="${jero.fileSuffixLimits}")
+    private String[] fileSuffixLimits;
 
     /**
      * @Author 政辉
@@ -81,6 +86,13 @@ public class CommonController {
         MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
         // 获取上传文件对象
         MultipartFile file = multipartRequest.getFile("file");
+        // 文件类型是否处于黑名单
+        if(CommonUtils.limitFileSuffix(file.getOriginalFilename(),fileSuffixLimits)){
+            result.setMessage("该文件类型不允许上传");
+            result.setSuccess(false);
+            result.setCode(0);
+            return result;
+        }
         if(oConvertUtils.isEmpty(bizPath)){
                 bizPath = "";
         }
@@ -94,6 +106,7 @@ public class CommonController {
         if(oConvertUtils.isNotEmpty(savePath)){
             //上传成功 进行数据库存储
             OSSFile ossFile = new OSSFile();
+            // 文件名
             String fileName = file.getOriginalFilename();
             fileName = CommonUtils.getFileName(fileName);
             ossFile.setFileName(fileName);
diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
index 66766c26..903ad1d7 100644
--- a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
+++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
@@ -244,6 +244,8 @@ jero :
     password:
     type: STANDALONE
     enabled: true
+  # 文件限制后缀黑名单
+  fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
 #cas单点登录
 cas:
   prefixUrl: http://cas.example.org:8443/cas
diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml
index f1475af8..8d3d7fad 100644
--- a/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml
+++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml
@@ -244,6 +244,8 @@ jero :
     password:
     type: STANDALONE
     enabled: true
+  # 文件限制后缀黑名单
+  fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
 #cas单点登录
 cas:
   prefixUrl: http://cas.example.org:8443/cas