perf(仪表板): 背景图片接口上传任意文件issue#4798

backend/src/main/java/io/dataease/controller/staticResource/StaticResourceController.java

@@ -16,7 +16,7 @@ import java.util.Map;
  * Description:
  */
 @RestController
-@RequestMapping("/static/resource")
+@RequestMapping("/staticResource")
 public class StaticResourceController {
 
     @Resource

backend/src/main/java/io/dataease/service/staticResource/StaticResourceService.java

@@ -3,6 +3,7 @@ package io.dataease.service.staticResource;
 import cn.hutool.core.codec.Base64Decoder;
 import cn.hutool.core.collection.CollectionUtil;
 import com.google.gson.Gson;
+import io.dataease.commons.exception.DEException;
 import io.dataease.commons.utils.FileUtils;
 import io.dataease.commons.utils.LogUtil;
 import io.dataease.commons.utils.StaticResourceUtils;
@@ -14,7 +15,10 @@ import org.springframework.util.Assert;
 import org.springframework.util.FileCopyUtils;
 import org.springframework.web.multipart.MultipartFile;
 
+import javax.imageio.ImageIO;
+import java.awt.image.BufferedImage;
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -35,6 +39,9 @@ public class StaticResourceService {
         // check if the path is valid (not outside staticDir)
         Assert.notNull(file, "Multipart file must not be null");
         try {
+            if (!isImage(file)) {
+                DEException.throwException("Multipart file must be image");
+            }
             String originName = file.getOriginalFilename();
             String newFileName = fileId + originName.substring(originName.lastIndexOf("."), originName.length());
             Path uploadPath = Paths.get(staticDir.toString(), newFileName);
@@ -50,6 +57,20 @@ public class StaticResourceService {
         }
     }
 
+    private boolean isImage(MultipartFile file) {
+        BufferedImage image = null;
+        try (InputStream input = file.getInputStream()) {
+            image = ImageIO.read(input);
+        } catch (IOException e) {
+            LogUtil.error(e.getMessage(), e);
+            return false;
+        }
+        if (image == null || image.getWidth() <= 0 || image.getHeight() <= 0) {
+            return false;
+        }
+        return true;
+    }
+
     public void saveFilesToServe(String staticResource) {
         Gson gson = new Gson();
         if (StringUtils.isNotEmpty(staticResource)) {

frontend/src/api/staticResource/staticResource.js

@@ -4,7 +4,7 @@ import store from '@/store'
 
 export function uploadFile(fileId, param) {
   return request({
-    url: '/static/resource/upload/' + fileId,
+    url: '/staticResource/upload/' + fileId,
     method: 'post',
     headers: { 'Content-Type': 'multipart/form-data' },
     data: param,
@@ -26,7 +26,7 @@ export function uploadFileResult(file, callback) {
 
 export function findResourceAsBase64(params) {
   return request({
-    url: '/static/resource/findResourceAsBase64',
+    url: '/staticResource/findResourceAsBase64',
     method: 'post',
     data: params,
     loading: false