【add】上传文件类型的黑名单限制

jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java

@@ -17,6 +17,8 @@ import java.io.InputStream;
 import java.sql.Connection;
 import java.sql.DatabaseMetaData;
 import java.sql.SQLException;
+import java.util.Arrays;
+import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -206,4 +208,17 @@ public class CommonUtils {
         return DB_TYPE;
 
     }
+    /**
+     * 黑名单限制文件
+     * @date 2021/4/14 6:18
+     * @param fileName 文件名
+     * @return boolean true：处于黑名单 false：不处于黑名单
+     */
+    public static boolean limitFileSuffix(String fileName,String[] fileSuffixLimits){
+        final List<String> fileNameList = Arrays.asList(fileSuffixLimits);
+        boolean isExists = fileNameList.stream().anyMatch(name -> fileName.substring(0,fileName.lastIndexOf('.')).contains(name)||fileName.substring(fileName.lastIndexOf('.')).equals(name));
+        return isExists;
+    }
+
+
 }

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java

@@ -57,6 +57,11 @@ public class CommonController {
      */
     @Value(value="${jero.uploadType}")
     private String uploadType;
+    /**
+     * 文件后缀黑名单
+     */
+    @Value(value="${jero.fileSuffixLimits}")
+    private String[] fileSuffixLimits;
 
     /**
      * @Author 政辉
@@ -81,6 +86,13 @@ public class CommonController {
         MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
         // 获取上传文件对象
         MultipartFile file = multipartRequest.getFile("file");
+        // 文件类型是否处于黑名单
+        if(CommonUtils.limitFileSuffix(file.getOriginalFilename(),fileSuffixLimits)){
+            result.setMessage("该文件类型不允许上传");
+            result.setSuccess(false);
+            result.setCode(0);
+            return result;
+        }
         if(oConvertUtils.isEmpty(bizPath)){
                 bizPath = "";
         }
@@ -94,6 +106,7 @@ public class CommonController {
         if(oConvertUtils.isNotEmpty(savePath)){
             //上传成功 进行数据库存储
             OSSFile ossFile = new OSSFile();
+            // 文件名
             String fileName = file.getOriginalFilename();
             fileName = CommonUtils.getFileName(fileName);
             ossFile.setFileName(fileName);

jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml

@@ -244,6 +244,8 @@ jero :
     password:
     type: STANDALONE
     enabled: true
+  # 文件限制后缀黑名单
+  fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
 #cas单点登录
 cas:
   prefixUrl: http://cas.example.org:8443/cas

jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml

@@ -244,6 +244,8 @@ jero :
     password:
     type: STANDALONE
     enabled: true
+  # 文件限制后缀黑名单
+  fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
 #cas单点登录
 cas:
   prefixUrl: http://cas.example.org:8443/cas