github
/
jeecg-boot
mirror of https://github.com/jeecgboot/jeecg-boot
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

上传接口对文件类型进行限制，避免恶意脚本上传攻击风险

pull/4246/merge
zhangdaiscott 2022-11-02 23:01:16 +08:00
parent f18ced524c
commit ff77973a6c
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java
View File

@ -10,6 +10,7 @@ import org.jeecg.common.exception.JeecgBootException;
import org.jeecg.common.util.CommonUtils; import org.jeecg.common.util.CommonUtils;
import org.jeecg.common.util.RestUtil; import org.jeecg.common.util.RestUtil;
import org.jeecg.common.util.TokenUtils; import org.jeecg.common.util.TokenUtils;
import org.jeecg.common.util.filter.FileTypeFilter;
import org.jeecg.common.util.oConvertUtils; import org.jeecg.common.util.oConvertUtils;
import org.springframework.beans.factory.annotation.Value; import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
@ -28,6 +29,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
import java.io.*; import java.io.*;
import java.net.URLDecoder; import java.net.URLDecoder;
/** /**
* <p> * <p>
* 用户表 前端控制器 * 用户表 前端控制器
@ -66,7 +68,7 @@ public class CommonController {
* @return * @return
*/ */
@PostMapping(value = "/upload") @PostMapping(value = "/upload")
public Result<?> upload(HttpServletRequest request, HttpServletResponse response) { public Result<?> upload(HttpServletRequest request, HttpServletResponse response) throws Exception {
Result<?> result = new Result<>(); Result<?> result = new Result<>();
String savePath = ""; String savePath = "";
String bizPath = request.getParameter("biz"); String bizPath = request.getParameter("biz");
@ -93,6 +95,9 @@ public class CommonController {
} }
} }
if(CommonConstant.UPLOAD_TYPE_LOCAL.equals(uploadType)){ if(CommonConstant.UPLOAD_TYPE_LOCAL.equals(uploadType)){
//update-begin-author:liusq date:20221102 for: 过滤上传文件类型
FileTypeFilter.fileTypeFilter(file);
//update-end-author:liusq date:20221102 for: 过滤上传文件类型
//update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传 //update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传
savePath = this.uploadLocal(file,bizPath); savePath = this.uploadLocal(file,bizPath);
//update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传 //update-begin-author:lvdandan date:20200928 for:修改JEditor编辑器本地上传