BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 64516b22106294f541c07a443cc6358fda56c1a0

Authored by YunaiV
1 parent e7c9e3dc

fix：【INFRA 基础设施】文件上传时，directory 支持任意路径的问题

Inline Side-by-side
Showing 2 changed files with 18 additions and 0 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/vo/file/FileUploadReqVO.java
  View file @64516b2
1 package cn.iocoder.yudao.module.infra.controller.admin.file.vo.file; 1 package cn.iocoder.yudao.module.infra.controller.admin.file.vo.file;
2 2
  3 +import cn.hutool.core.util.StrUtil;
  4 +import com.fasterxml.jackson.annotation.JsonIgnore;
3 import io.swagger.v3.oas.annotations.media.Schema; 5 import io.swagger.v3.oas.annotations.media.Schema;
  6 +import jakarta.validation.constraints.AssertTrue;
4 import jakarta.validation.constraints.NotNull; 7 import jakarta.validation.constraints.NotNull;
5 import lombok.Data; 8 import lombok.Data;
6 import org.springframework.web.multipart.MultipartFile; 9 import org.springframework.web.multipart.MultipartFile;
@@ -16,4 +19,10 @@ public class FileUploadReqVO { @@ -16,4 +19,10 @@ public class FileUploadReqVO {
16 @Schema(description = "文件目录", example = "XXX/YYY") 19 @Schema(description = "文件目录", example = "XXX/YYY")
17 private String directory; 20 private String directory;
18 21
  22 + @AssertTrue(message = "文件目录不正确")
  23 + @JsonIgnore
  24 + public boolean isDirectoryValid() {
  25 + return !StrUtil.containsAny(directory, "..", "/", "\\");
  26 + }
  27 +
19 } 28 }
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/app/file/vo/AppFileUploadReqVO.java
  View file @64516b2
1 package cn.iocoder.yudao.module.infra.controller.app.file.vo; 1 package cn.iocoder.yudao.module.infra.controller.app.file.vo;
2 2
  3 +import cn.hutool.core.util.StrUtil;
  4 +import com.fasterxml.jackson.annotation.JsonIgnore;
3 import io.swagger.v3.oas.annotations.media.Schema; 5 import io.swagger.v3.oas.annotations.media.Schema;
  6 +import jakarta.validation.constraints.AssertTrue;
4 import jakarta.validation.constraints.NotNull; 7 import jakarta.validation.constraints.NotNull;
5 import lombok.Data; 8 import lombok.Data;
6 import org.springframework.web.multipart.MultipartFile; 9 import org.springframework.web.multipart.MultipartFile;
@@ -16,4 +19,10 @@ public class AppFileUploadReqVO { @@ -16,4 +19,10 @@ public class AppFileUploadReqVO {
16 @Schema(description = "文件目录", example = "XXX/YYY") 19 @Schema(description = "文件目录", example = "XXX/YYY")
17 private String directory; 20 private String directory;
18 21
  22 + @AssertTrue(message = "文件目录不正确")
  23 + @JsonIgnore
  24 + public boolean isDirectoryValid() {
  25 + return !StrUtil.containsAny(directory, "..", "/", "\\");
  26 + }
  27 +
19 } 28 }