【修改】各类bug修复

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/CommonController.java

@@ -83,6 +83,12 @@ public class CommonController {
         Result<OSSFile> result = new Result<>();
         String savePath = "";
         String bizPath = request.getParameter("biz");
+
+        //sys/common/upload接口存在任意文件上传漏洞
+        if (oConvertUtils.isNotEmpty(bizPath) && (bizPath.contains("../") || bizPath.contains("..\\"))) {
+            throw new JeroBootException("上传目录bizPath，格式非法！");
+        }
+
         MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
         // 获取上传文件对象
         MultipartFile file = multipartRequest.getFile("file");