From fa5de1c9c214ae8ce816df4ab334ed5835813fed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=A2=81=E7=90=A6=E6=B6=9B?= <liangqitao@syxysoft.com>
Date: Fri, 13 Sep 2024 11:11:39 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A7=A3=E5=86=B3=E6=96=87=E4=BB=B6=E4=B8=8A?=
 =?UTF-8?q?=E4=BC=A0=E6=96=87=E4=BB=B6=E6=BC=8F=E6=B4=9E=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../service/impl/LawsCommonServiceImpl.java    |  5 +++++
 .../jero/modules/split/common/FileUnZip.java   | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
index 4bd74645..6cedf0c8 100644
--- a/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java
@@ -1581,6 +1581,11 @@ public class LawsCommonServiceImpl implements ILawsCommonService {
             throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
         }
 
+        String contentType = file.getContentType();
+        if (!contentType.contains("zip")) {
+            throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
+        }
+
         Path path = Files.createTempDirectory("temp");
         File saveDirectory = new File(path.toUri());
         if (!saveDirectory.isDirectory()) {
diff --git a/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java b/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
index 04d24998..098f5de8 100644
--- a/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
+++ b/laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java
@@ -1,6 +1,9 @@
 package com.jero.modules.split.common;
 
+import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.constant.enums.LanguageEnum;
+import com.jero.common.exception.JeroBootException;
+import com.jero.common.util.MessageUtils;
 import com.xkcoding.http.util.StringUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.tools.zip.ZipEntry;
@@ -53,6 +56,9 @@ public class FileUnZip {
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
                 file.mkdirs();
             }else{
+                if (!isFileSafe(zipEntryName)) {
+                    throw new JeroBootException(MessageUtils.getMessage(ResultCommon.ERROR));
+                }
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
             }
             //判断文件全路径是否为文件夹,如果是上面已经上传,不需要解压
@@ -77,6 +83,18 @@ public class FileUnZip {
         return orgMkdirs;
     }
 
+    private static boolean isFileSafe(String fileName) {
+        // 添加文件类型检查逻辑
+        // 这里仅作为一个示例，实际应用中需要根据需要进行扩展
+        String[] unsafeExtensions = {".exe", ".sh", ".bat", ".js"};
+        for (String ext : unsafeExtensions) {
+            if (fileName.endsWith(ext)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     /**
      * 解压zip文件
      * 解决解压文件下有多个文件夹时，读不到orgMkdirs问题