解决文件上传文件漏洞问题

2024-09-13 11:11:39 +08:00
parent 1bd0eb86be
commit fa5de1c9c2
2 changed files with 23 additions and 0 deletions
@@ -1581,6 +1581,11 @@ public class LawsCommonServiceImpl implements ILawsCommonService {
            throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
        }

+        String contentType = file.getContentType();
+        if (!contentType.contains("zip")) {
+            throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
+        }
+
        Path path = Files.createTempDirectory("temp");
        File saveDirectory = new File(path.toUri());
        if (!saveDirectory.isDirectory()) {
@@ -1,6 +1,9 @@
 package com.jero.modules.split.common;

+import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.constant.enums.LanguageEnum;
+import com.jero.common.exception.JeroBootException;
+import com.jero.common.util.MessageUtils;
 import com.xkcoding.http.util.StringUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.tools.zip.ZipEntry;
@@ -53,6 +56,9 @@ public class FileUnZip {
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
                file.mkdirs();
            }else{
+                if (!isFileSafe(zipEntryName)) {
+                    throw new JeroBootException(MessageUtils.getMessage(ResultCommon.ERROR));
+                }
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
            }
            //判断文件全路径是否为文件夹,如果是上面已经上传,不需要解压
@@ -77,6 +83,18 @@ public class FileUnZip {
        return orgMkdirs;
    }

+    private static boolean isFileSafe(String fileName) {
+        // 添加文件类型检查逻辑
+        // 这里仅作为一个示例，实际应用中需要根据需要进行扩展
+        String[] unsafeExtensions = {".exe", ".sh", ".bat", ".js"};
+        for (String ext : unsafeExtensions) {
+            if (fileName.endsWith(ext)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
    /**
     * 解压zip文件
     * 解决解压文件下有多个文件夹时，读不到orgMkdirs问题