dongjunchuan/de
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(仪表板): 修复不安全上传文件路径问题

Browse Source
This commit is contained in:
wangjiahao 2024-03-27 16:06:39 +08:00
parent 6d79bd52bd
commit 8de7337f19
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/backend/src/main/java/io/dataease/service/staticResource/StaticResourceService.java
View File

@ -44,9 +44,10 @@ public class StaticResourceService {
} }
String originName = file.getOriginalFilename(); String originName = file.getOriginalFilename();
String newFileName = fileId + originName.substring(originName.lastIndexOf("."), originName.length()); String newFileName = fileId + originName.substring(originName.lastIndexOf("."), originName.length());
Path uploadPath = Paths.get(staticDir.toString(), newFileName); Path basePath = Paths.get(staticDir.toString());
// create dir is absent // create dir is absent
FileUtils.createIfAbsent(Paths.get(staticDir.toString())); FileUtils.createIfAbsent(basePath);
Path uploadPath = basePath.resolve(newFileName);
Files.createFile(uploadPath); Files.createFile(uploadPath);
file.transferTo(uploadPath); file.transferTo(uploadPath);
} catch (IOException e) { } catch (IOException e) {
@ -86,9 +87,10 @@ public class StaticResourceService {
} }
public void saveSingleFileToServe(String fileName, String content) { public void saveSingleFileToServe(String fileName, String content) {
Path uploadPath = Paths.get(staticDir.toString(), fileName); Path basePath = Paths.get(staticDir.toString());
Path uploadPath = basePath.resolve(fileName);
try { try {
if (uploadPath.toFile().exists()) { if (Files.exists(uploadPath)) {
LogUtil.info("file exists"); LogUtil.info("file exists");
} else { } else {
if (StringUtils.isNotEmpty(content)) { if (StringUtils.isNotEmpty(content)) {