KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复任意文件上传windows的&&DATA文件流安全问题

Browse Source
This commit is contained in:
zer0Black
2023-06-09 18:16:05 +08:00
parent cb90af443f
commit 9d2fc8dad7
4 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/util/CommonUtils.java
+2 -1
View File
@@ -253,7 +253,8 @@ public class CommonUtils {
*/ */
public static boolean limitFileSuffix(String fileName,String[] fileSuffixLimits){ public static boolean limitFileSuffix(String fileName,String[] fileSuffixLimits){
final List<String> fileNameList = Arrays.asList(fileSuffixLimits); final List<String> fileNameList = Arrays.asList(fileSuffixLimits);
return fileNameList.stream().anyMatch(name -> fileName.substring(0,fileName.lastIndexOf('.')).contains(name)||fileName.substring(fileName.lastIndexOf('.')).equals(name)); boolean isExists = fileNameList.stream().anyMatch(name -> fileName.substring(0,fileName.lastIndexOf('.')).contains(name)||fileName.substring(fileName.lastIndexOf('.')).contains(name));
return isExists;
} }
/** /**
* RSA 使用私钥解密 * RSA 使用私钥解密
jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
+1 -1
View File
@@ -270,7 +270,7 @@ jero:
type: STANDALONE type: STANDALONE
enabled: true enabled: true
# 文件限制后缀黑名单 # 文件限制后缀黑名单
fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin,$DATA
# 跨站白名单 # 跨站白名单
whiteUrls: localhost:3000,localhost:8080 whiteUrls: localhost:3000,localhost:8080
# xss白名单 # xss白名单
jero-boot/jero-boot-single-startup/src/main/resources/application-prod.yml
+1 -1
View File
@@ -271,7 +271,7 @@ jero:
type: STANDALONE type: STANDALONE
enabled: true enabled: true
# 文件限制后缀黑名单 # 文件限制后缀黑名单
fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin,$DATA
# 跨站白名单 # 跨站白名单
whiteUrls: localhost:3000,localhost:8080 whiteUrls: localhost:3000,localhost:8080
# xss白名单 # xss白名单
jero-boot/jero-boot-single-startup/src/main/resources/application-test.yml
+1 -1
View File
@@ -270,7 +270,7 @@ jero:
type: STANDALONE type: STANDALONE
enabled: true enabled: true
# 文件限制后缀黑名单 # 文件限制后缀黑名单
fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin,$DATA
# 跨站白名单 # 跨站白名单
whiteUrls: localhost:3000,localhost:8080 whiteUrls: localhost:3000,localhost:8080
# xss白名单 # xss白名单