center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

Merge pull request #8739 from dataease/pr@dev-v2@fix_path

Browse Source 
fix(仪表板): 修改任意上传文件不安全操作路径缺陷
This commit is contained in:
王嘉豪 2024-03-27 16:09:10 +08:00 committed by GitHub
commit ccb6233075
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java
View File

@ -43,9 +43,10 @@ public class StaticResourceServer implements StaticResourceApi {
}
String originName = file.getOriginalFilename();
String newFileName = fileId + originName.substring(originName.lastIndexOf("."), originName.length());
Path uploadPath = Paths.get(staticDir.toString(), newFileName);
Path basePath = Paths.get(staticDir.toString());
// create dir is absent
FileUtils.createIfAbsent(Paths.get(staticDir.toString()));
FileUtils.createIfAbsent(basePath);
Path uploadPath = basePath.resolve(newFileName);
Files.createFile(uploadPath);
file.transferTo(uploadPath);
} catch (IOException e) {
@ -82,9 +83,10 @@ public class StaticResourceServer implements StaticResourceApi {
}
public void saveSingleFileToServe(String fileName, String content) {
Path uploadPath = Paths.get(staticDir.toString(), fileName);
Path basePath = Paths.get(staticDir.toString());
Path uploadPath = basePath.resolve(fileName);
try {
if (uploadPath.toFile().exists()) {
if (Files.exists(uploadPath)) {
LogUtil.info("file exists");
} else {
if (StringUtils.isNotEmpty(content)) {