dongjunchuan/de
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #8738 from dataease/pr@dev@fix_path

Browse Source 
fix(仪表板): 修复不安全上传文件路径问题
This commit is contained in:
王嘉豪 2024-03-27 16:07:47 +08:00 committed by GitHub
commit 764d2f7f14
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/backend/src/main/java/io/dataease/service/staticResource/StaticResourceService.java
View File

@ -44,9 +44,10 @@ public class StaticResourceService {
}
String originName = file.getOriginalFilename();
String newFileName = fileId + originName.substring(originName.lastIndexOf("."), originName.length());
Path uploadPath = Paths.get(staticDir.toString(), newFileName);
Path basePath = Paths.get(staticDir.toString());
// create dir is absent
FileUtils.createIfAbsent(Paths.get(staticDir.toString()));
FileUtils.createIfAbsent(basePath);
Path uploadPath = basePath.resolve(newFileName);
Files.createFile(uploadPath);
file.transferTo(uploadPath);
} catch (IOException e) {
@ -86,9 +87,10 @@ public class StaticResourceService {
}
public void saveSingleFileToServe(String fileName, String content) {
Path uploadPath = Paths.get(staticDir.toString(), fileName);
Path basePath = Paths.get(staticDir.toString());
Path uploadPath = basePath.resolve(fileName);
try {
if (uploadPath.toFile().exists()) {
if (Files.exists(uploadPath)) {
LogUtil.info("file exists");
} else {
if (StringUtils.isNotEmpty(content)) {