解决文件上传文件漏洞问题

laws-modules/src/main/java/com/jero/modules/laws/common/service/impl/LawsCommonServiceImpl.java

@@ -1581,6 +1581,11 @@ public class LawsCommonServiceImpl implements ILawsCommonService {
             throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
         }
 
+        String contentType = file.getContentType();
+        if (!contentType.contains("zip")) {
+            throw new JeroBootException(MessageUtils.getMessage(ResultCommon.PLEASE_UPLOAD_ZIP));
+        }
+
         Path path = Files.createTempDirectory("temp");
         File saveDirectory = new File(path.toUri());
         if (!saveDirectory.isDirectory()) {

laws-modules/src/main/java/com/jero/modules/split/common/FileUnZip.java

@@ -1,6 +1,9 @@
 package com.jero.modules.split.common;
 
+import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.constant.enums.LanguageEnum;
+import com.jero.common.exception.JeroBootException;
+import com.jero.common.util.MessageUtils;
 import com.xkcoding.http.util.StringUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.tools.zip.ZipEntry;
@@ -53,6 +56,9 @@ public class FileUnZip {
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
                 file.mkdirs();
             }else{
+                if (!isFileSafe(zipEntryName)) {
+                    throw new JeroBootException(MessageUtils.getMessage(ResultCommon.ERROR));
+                }
 //                orgMkdirs = outPath.substring(0, outPath.lastIndexOf('/'));
             }
             //判断文件全路径是否为文件夹,如果是上面已经上传,不需要解压
@@ -77,6 +83,18 @@ public class FileUnZip {
         return orgMkdirs;
     }
 
+    private static boolean isFileSafe(String fileName) {
+        // 添加文件类型检查逻辑
+        // 这里仅作为一个示例，实际应用中需要根据需要进行扩展
+        String[] unsafeExtensions = {".exe", ".sh", ".bat", ".js"};
+        for (String ext : unsafeExtensions) {
+            if (fileName.endsWith(ext)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     /**
      * 解压zip文件
      * 解决解压文件下有多个文件夹时，读不到orgMkdirs问题