hz/java-servers
1
0
Fork 0
mirror of https://codeup.aliyun.com/67762337eccfc218f6110e0e/per-boe/java-servers.git synced 2025-12-10 11:26:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

路径遍历

Browse Source
This commit is contained in:
yang
2024-08-26 17:00:10 +08:00
parent 776e1e6cbc
commit bea6d680e9
8 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
modules/boe-module-scorm/src/main/java/com/xboe/module/scorm/cam/load/ContentPackageGenerator.java
View File

@@ -119,6 +119,10 @@ public class ContentPackageGenerator {
private String scormPkgDir;
public ContentPackage generateContentPackageFromFile(String scormPkgDir) {
if (scormPkgDir.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
if (scormPkgDir == null) {
log.error("scorm package directory is null");
return contentPackage;

4
modules/boe-module-scorm/src/main/java/com/xboe/module/scorm/cam/load/FileUtils.java
View File

@@ -44,6 +44,10 @@ public class FileUtils {
}
public static File createFile(String dstPath, String fileName) throws IOException {
if (dstPath.contains("..") || fileName.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
String[] dirs = fileName.split("/");
File file = new File(dstPath);

5
modules/boe-module-scorm/src/main/java/com/xboe/module/scorm/cam/load/SCORMPackageManager.java
View File

@@ -119,6 +119,11 @@ public class SCORMPackageManager {
return null;
}
if (packagePath.contains("..")) {
// throw new SecurityException("输入路径包含不安全的字符");
return null;
}
// step 1: uncompress
File f=new File(packagePath);
if(!f.exists()) {

4
modules/boe-module-scorm/src/main/java/com/xboe/module/scorm/cam/load/ZipUtils.java
View File

@@ -60,6 +60,10 @@ public class ZipUtils {
}
public static boolean decompressZip(String zipFilePath, String saveFileDir) {
if (saveFileDir.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
if (!isEndWithZip(zipFilePath)) {
return false;
}

4
servers/boe-server-all/src/main/java/com/xboe/converter/ExcelToPdfConverter.java
View File

@@ -66,6 +66,10 @@ public class ExcelToPdfConverter implements ICourseFileConverter {
@Override
public String convert(String fileType, String filePath) throws Exception{
if (filePath.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
if (this.getLicense()) {
FileOutputStream fileOS=null;
String previewPath = null;

4
servers/boe-server-all/src/main/java/com/xboe/converter/PPTToPdfConverter.java
View File

@@ -65,6 +65,10 @@ public class PPTToPdfConverter implements ICourseFileConverter {
@Override
public String convert(String fileType, String filePath) throws Exception{
if (filePath.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
if (this.getLicense()) {
InputStream slides=null;
Presentation pres=null;

4
servers/boe-server-all/src/main/java/com/xboe/converter/WordToPdfConverter.java
View File

@@ -69,6 +69,10 @@ public class WordToPdfConverter implements ICourseFileConverter {
@Override
public String convert(String fileType, String filePath) throws Exception{
if (filePath.contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
if (this.getLicense()) {
File pdfFile=null;
FileOutputStream fileOS=null;

13
servers/boe-server-all/src/main/java/com/xboe/module/course/api/CourseFileApi.java
View File

@@ -227,6 +227,10 @@ public class CourseFileApi extends ApiBaseController {
return badRequest("请先选择资源归属");
}
if (file.getFilePath().contains("..")) {
throw new SecurityException("输入路径包含不安全的字符");
}
// 重设文件类型为小写
file.setFileType(file.getFileType().toLowerCase());
@@ -396,7 +400,14 @@ public class CourseFileApi extends ApiBaseController {
return;
}
String cfPath=null;
if (cf.contains("..")) {
log.error("参数错误");
// throw new SecurityException("输入路径包含不安全的字符");
return;
}
String cfPath=null;
String fileName ="";
if(StringUtils.isNotBlank(cf)) {
cfPath=cf;