hz/java-servers
1
0
Fork 0
mirror of https://codeup.aliyun.com/67762337eccfc218f6110e0e/per-boe/java-servers.git synced 2025-12-16 22:36:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

资源注入、服务器端请求伪造

Browse Source
This commit is contained in:
yang
2024-08-26 16:57:39 +08:00
parent 1482809b0f
commit 19c3221153
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
servers/boe-server-all/src/main/java/com/xboe/system/api/SysUploaderApi.java
View File

@@ -16,6 +16,7 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
@@ -43,6 +44,9 @@ public class SysUploaderApi extends ApiBaseController{
@Autowired @Autowired
XFileUploader uploader; XFileUploader uploader;
@Value(value = "${boe.domain}")
String domain;
private static Set<String> fileTypeSet=new HashSet<>(); private static Set<String> fileTypeSet=new HashSet<>();
static { static {
@@ -149,7 +153,8 @@ public class SysUploaderApi extends ApiBaseController{
@RequestMapping(value = "/url/download", method = RequestMethod.GET) @RequestMapping(value = "/url/download", method = RequestMethod.GET)
public void urlDownload(HttpServletResponse res,String urlStr,String fileName) throws IOException { public void urlDownload(HttpServletResponse res,String urlStr,String fileName) throws IOException {
URL url = new URL(urlStr); URL url = new URL(urlStr);
downloadLimitation(url);
HttpURLConnection conn = (HttpURLConnection)url.openConnection(); HttpURLConnection conn = (HttpURLConnection)url.openConnection();
//设置超时间为3秒 //设置超时间为3秒
conn.setConnectTimeout(3*1000); conn.setConnectTimeout(3*1000);
@@ -193,4 +198,19 @@ public class SysUploaderApi extends ApiBaseController{
//System.out.println("success"); //System.out.println("success");
} }
private void downloadLimitation(URL url) {
String allowedDomain = domain;
String allowedPathPrefix = "/upload/xfile/";
// 检查域名是否正确
if (!url.getHost().equals(allowedDomain)) {
throw new SecurityException("Download from this domain is not allowed.");
}
// 检查路径是否以允许的路径前缀开始
if (!url.getPath().startsWith(allowedPathPrefix)) {
throw new SecurityException("Download from this path is not allowed.");
}
}
} }