fix(infra): 防止上传文件通过 SVG 响应执行脚本

YunaiV
1 parent 4ee2d0f6
Showing 5 changed files with 227 additions and 4 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/file/core/client/s3/S3FileClient.java
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/file/core/utils/FileTypeUtils.java
yudao-module-infra/src/test/java/cn/iocoder/yudao/module/infra/framework/file/core/s3/S3FileClientTest.java
yudao-module-infra/src/test/java/cn/iocoder/yudao/module/infra/framework/file/core/utils/FileTypeUtilsTest.java
yudao-module-infra/src/test/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImplTest.java
@@ -6,6 +6,7 @@ import cn.hutool.core.util.StrUtil;
 import cn.hutool.http.HttpUtil;
 import cn.iocoder.yudao.framework.common.util.http.HttpUtils;
 import cn.iocoder.yudao.module.infra.framework.file.core.client.AbstractFileClient;
+import cn.iocoder.yudao.module.infra.framework.file.core.utils.FileTypeUtils;
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
@@ -33,6 +34,8 @@ public class S3FileClient extends AbstractFileClient&lt;S3FileClientConfig&gt; {
     private static final Duration EXPIRATION_DEFAULT = Duration.ofHours(24);
+    private static final String CONTENT_DISPOSITION_ATTACHMENT = "attachment";
+
     private S3Client client;
     private S3Presigner presigner;
@@ -79,6 +82,8 @@ public class S3FileClient extends AbstractFileClient&lt;S3FileClientConfig&gt; {
                 .bucket(config.getBucket())
                 .key(path)
                 .contentType(type)
+                // SVG 等可携带脚本的文件：直链直接打开时按附件下载；页面中作为图片引用时不受影响
+                .contentDisposition(FileTypeUtils.isScriptable(type) ? CONTENT_DISPOSITION_ATTACHMENT : null)
                 .contentLength((long) content.length)
                 .build();
         // 上传文件
@@ -133,9 +138,14 @@ public class S3FileClient extends AbstractFileClient&lt;S3FileClientConfig&gt; {
         // 2.2 情况二：私有访问：生成 GET 预签名 URL
         String finalPath = path;
         Duration expiration = expirationSeconds != null ? Duration.ofSeconds(expirationSeconds) : EXPIRATION_DEFAULT;
+        // 新签发的私有 URL：对象 key 扩展名为 SVG 等可携带脚本的类型时，要求按附件下载
+        // 注意：不覆盖公开访问、已签发的 URL，以及扩展名与 Content-Type 不一致的直传对象
+        String contentDisposition = FileTypeUtils.isScriptable(FileTypeUtils.getMineType(finalPath))
+                ? CONTENT_DISPOSITION_ATTACHMENT : null;
         URL signedUrl = presigner.presignGetObject(GetObjectPresignRequest.builder()
                 .signatureDuration(expiration)
-                .getObjectRequest(b -> b.bucket(config.getBucket()).key(finalPath)).build())
+                .getObjectRequest(b -> b.bucket(config.getBucket()).key(finalPath)
+                        .responseContentDisposition(contentDisposition)).build())
                 .url();
         return signedUrl.toString();
     }
@@ -81,13 +81,24 @@ public class FileTypeUtils {
     public static void writeAttachment(HttpServletResponse response, String filename, byte[] content) throws IOException {
         // 设置 header 和 contentType
         String mineType = getMineType(content, filename);
+        // 文件名可能伪装，按内容识别为 SVG、HTML、XML 等可携带脚本的类型时，以内容为准
+        String contentMineType = getMineType(content);
+        if (!isScriptable(mineType) && isScriptable(contentMineType)) {
+            mineType = contentMineType;
+        }
         response.setContentType(mineType);
+        response.setHeader("X-Content-Type-Options", "nosniff");
         // 设置内容显示、下载文件名：https://www.cnblogs.com/wq-9/articles/12165056.html
-        if (isImage(mineType)) {
+        if (isImage(mineType) && !isScriptable(mineType)) {
             // 参见 https://github.com/YunaiV/ruoyi-vue-pro/issues/692 讨论
             response.setHeader("Content-Disposition", buildContentDisposition("inline", filename));
         } else {
+            // SVG 等可携带脚本的文件：直接打开时按附件下载；保留原类型，页面中作为图片引用时仍可显示
             response.setHeader("Content-Disposition", buildContentDisposition("attachment", filename));
+            // 被 object、embed 等嵌入时，按沙箱执行，禁止脚本、隔离来源
+            if (isScriptable(mineType)) {
+                response.setHeader("Content-Security-Policy", "sandbox");
+            }
         }
         // 针对 video 的特殊处理，解决视频地址在移动端播放的兼容性问题
         if (StrUtil.containsIgnoreCase(mineType, "video")) {
@@ -131,4 +142,16 @@ public class FileTypeUtils {
         return StrUtil.startWith(mineType, "image/");
     }
+    /**
+     * 判断是否是可携带脚本的类型，例如说 SVG、HTML、XHTML、XML，同源直接打开时会执行其中的脚本
+     *
+     * 注意：Office 的 openxmlformats 类型以 document、sheet 等结尾，不属于此类
+     *
+     * @param mineType 类型
+     * @return 是否可携带脚本
+     */
+    public static boolean isScriptable(String mineType) {
+        return StrUtil.containsAnyIgnoreCase(mineType, "svg", "html") || StrUtil.endWithIgnoreCase(mineType, "xml");
+    }
+
 }
@@ -2,16 +2,27 @@ package cn.iocoder.yudao.module.infra.framework.file.core.s3;
 import cn.hutool.core.io.resource.ResourceUtil;
 import cn.hutool.core.util.IdUtil;
+import cn.hutool.core.util.ReflectUtil;
+import cn.hutool.core.util.StrUtil;
 import cn.iocoder.yudao.framework.common.util.validation.ValidationUtils;
 import cn.iocoder.yudao.module.infra.framework.file.core.client.s3.S3FileClient;
 import cn.iocoder.yudao.module.infra.framework.file.core.client.s3.S3FileClientConfig;
 import jakarta.validation.Validation;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import software.amazon.awssdk.core.sync.RequestBody;
+import software.amazon.awssdk.services.s3.S3Client;
+import software.amazon.awssdk.services.s3.model.PutObjectRequest;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 @SuppressWarnings("resource")
 public class S3FileClientTest {
@@ -67,6 +78,68 @@ public class S3FileClientTest {
         assertTrue(result.contains("/yudao/avatar/%E4%B8%AD%E6%96%87%20100%25"));
         assertTrue(result.contains("%E6%96%87%E4%BB%B6.jpg"));
         assertFalse(result.contains("%25E4%25B8%25AD"));
+        assertFalse(result.contains("response-content-disposition"));
+    }
+
+    @Test
+    public void testPresignUrl_privateAccess_scriptableAttachment() {
+        // 准备参数
+        S3FileClientConfig config = new S3FileClientConfig();
+        config.setAccessKey("admin");
+        config.setAccessSecret("password");
+        config.setBucket("yudao");
+        config.setDomain("http://127.0.0.1:9000/yudao");
+        config.setEndpoint("http://127.0.0.1:9000");
+        config.setEnablePathStyleAccess(true);
+        config.setEnablePublicAccess(false);
+        S3FileClient client = new S3FileClient(0L, config);
+        client.init();
+
+        // 调用：新上传的 SVG、已保存的历史签名 URL 重新签名
+        String result = client.presignGetUrl("avatar/图标.svg", 300);
+        String historyResult = client.presignGetUrl(
+                "http://127.0.0.1:9000/yudao/avatar/%E5%9B%BE%E6%A0%87.svg?X-Amz-Signature=old", 300);
+        String putResult = client.presignPutUrl("avatar/图标.svg");
+
+        // 断言：GET 签名要求按附件下载；PUT 签名不额外约束请求头，兼容前端直传
+        assertTrue(result.contains("/yudao/avatar/%E5%9B%BE%E6%A0%87.svg"));
+        assertTrue(result.contains("response-content-disposition=attachment"));
+        assertTrue(historyResult.contains("/yudao/avatar/%E5%9B%BE%E6%A0%87.svg"));
+        assertTrue(historyResult.contains("response-content-disposition=attachment"));
+        assertFalse(historyResult.contains("X-Amz-Signature=old"));
+        assertFalse(StrUtil.containsIgnoreCase(putResult, "content-disposition"));
+    }
+
+    @Test
+    public void testUpload_scriptableContentDisposition() {
+        // 准备参数
+        S3FileClientConfig config = new S3FileClientConfig();
+        config.setAccessKey("admin");
+        config.setAccessSecret("password");
+        config.setBucket("yudao");
+        config.setDomain("http://127.0.0.1:9000/yudao");
+        config.setEndpoint("http://127.0.0.1:9000");
+        config.setEnablePathStyleAccess(true);
+        config.setEnablePublicAccess(true);
+        S3FileClient client = new S3FileClient(0L, config);
+        client.init();
+        // mock S3 客户端
+        S3Client s3Client = mock(S3Client.class);
+        ReflectUtil.setFieldValue(client, "client", s3Client);
+
+        // 调用
+        client.upload(new byte[]{1}, "avatar/图标.svg", "image/svg+xml");
+        client.upload(new byte[]{1}, "avatar/页面.html", "text/html");
+        client.upload(new byte[]{1}, "avatar/头像.jpg", "image/jpeg");
+
+        // 断言：可携带脚本的对象按附件下载，普通图片不设置
+        ArgumentCaptor<PutObjectRequest> requestCaptor = ArgumentCaptor.forClass(PutObjectRequest.class);
+        verify(s3Client, times(3)).putObject(requestCaptor.capture(), any(RequestBody.class));
+        assertEquals("image/svg+xml", requestCaptor.getAllValues().get(0).contentType());
+        assertEquals("attachment", requestCaptor.getAllValues().get(0).contentDisposition());
+        assertEquals("attachment", requestCaptor.getAllValues().get(1).contentDisposition());
+        assertEquals("image/jpeg", requestCaptor.getAllValues().get(2).contentType());
+        assertNull(requestCaptor.getAllValues().get(2).contentDisposition());
     }
     @Test
 package cn.iocoder.yudao.module.infra.framework.file.core.utils;
+import cn.hutool.core.io.resource.ResourceUtil;
 import org.junit.jupiter.api.Test;
 import org.springframework.mock.web.MockHttpServletResponse;
 import java.nio.charset.StandardCharsets;
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.*;
 /**
  * {@link FileTypeUtils} 的单元测试
@@ -26,7 +26,102 @@ public class FileTypeUtilsTest {
         assertEquals("attachment;filename=\"__ 100%+__.txt\";"
                 + "filename*=UTF-8''%E4%B8%AD%E6%96%87%20100%25+%E6%96%87%E4%BB%B6.txt",
                 response.getHeader("Content-Disposition"));
+        assertEquals("nosniff", response.getHeader("X-Content-Type-Options"));
+        assertNull(response.getHeader("Content-Security-Policy"));
         assertArrayEquals(content, response.getContentAsByteArray());
     }
+    @Test
+    public void testWriteAttachment_imageInline() throws Exception {
+        // 准备参数
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        byte[] content = ResourceUtil.readBytes("file/erweima.jpg");
+
+        // 调用
+        FileTypeUtils.writeAttachment(response, "头像.jpg", content);
+
+        // 断言：普通位图保持 inline，可直接预览
+        assertEquals("image/jpeg", response.getContentType());
+        assertEquals("inline;filename=\"__.jpg\";filename*=UTF-8''%E5%A4%B4%E5%83%8F.jpg",
+                response.getHeader("Content-Disposition"));
+        assertEquals("nosniff", response.getHeader("X-Content-Type-Options"));
+        assertNull(response.getHeader("Content-Security-Policy"));
+        assertArrayEquals(content, response.getContentAsByteArray());
+    }
+
+    @Test
+    public void testWriteAttachment_scriptableAttachment() throws Exception {
+        // 历史已上传的 SVG、HTML、XML 文件，没有文件记录时按路径中的文件名下载
+        for (String[] document : new String[][]{
+                {"图标.svg", "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>",
+                        "image/svg+xml", "attachment;filename=\"__.svg\";filename*=UTF-8''%E5%9B%BE%E6%A0%87.svg"},
+                {"页面.html", "<html><script>alert(1)</script></html>",
+                        "text/html", "attachment;filename=\"__.html\";filename*=UTF-8''%E9%A1%B5%E9%9D%A2.html"},
+                {"数据.xml", "<?xml version=\"1.0\"?><root>test</root>",
+                        "application/xml", "attachment;filename=\"__.xml\";filename*=UTF-8''%E6%95%B0%E6%8D%AE.xml"}}) {
+            // 准备参数
+            MockHttpServletResponse response = new MockHttpServletResponse();
+            byte[] content = document[1].getBytes(StandardCharsets.UTF_8);
+
+            // 调用
+            FileTypeUtils.writeAttachment(response, document[0], content);
+
+            // 断言：保留原类型，直接打开时按附件下载，嵌入时按沙箱执行
+            assertEquals(document[2], response.getContentType());
+            assertEquals(document[3], response.getHeader("Content-Disposition"));
+            assertEquals("nosniff", response.getHeader("X-Content-Type-Options"));
+            assertEquals("sandbox", response.getHeader("Content-Security-Policy"));
+            assertArrayEquals(content, response.getContentAsByteArray());
+        }
+    }
+
+    @Test
+    public void testWriteAttachment_fakeImageNameDetectContent() throws Exception {
+        // 准备参数：SVG 内容伪装成 png 文件名
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        byte[] content = "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>"
+                .getBytes(StandardCharsets.UTF_8);
+
+        // 调用
+        FileTypeUtils.writeAttachment(response, "图标.png", content);
+
+        // 断言：以内容识别的 SVG 类型为准，按附件下载
+        assertEquals("image/svg+xml", response.getContentType());
+        assertEquals("attachment;filename=\"__.png\";filename*=UTF-8''%E5%9B%BE%E6%A0%87.png",
+                response.getHeader("Content-Disposition"));
+        assertEquals("nosniff", response.getHeader("X-Content-Type-Options"));
+        assertEquals("sandbox", response.getHeader("Content-Security-Policy"));
+    }
+
+    @Test
+    public void testWriteAttachment_imageNameHintDetectContent() throws Exception {
+        // 准备参数：XML 内容，文件名提示会把类型识别为图片（image/vnd.adobe.premiere）
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        byte[] content = "<?xml version=\"1.0\"?><root>test</root>".getBytes(StandardCharsets.UTF_8);
+
+        // 调用
+        FileTypeUtils.writeAttachment(response, "test.ppj", content);
+
+        // 断言：仅按内容识别为 XML 时以内容为准，不按图片 inline
+        assertEquals("application/xml", response.getContentType());
+        assertEquals("attachment;filename=\"test.ppj\";filename*=UTF-8''test.ppj",
+                response.getHeader("Content-Disposition"));
+        assertEquals("nosniff", response.getHeader("X-Content-Type-Options"));
+        assertEquals("sandbox", response.getHeader("Content-Security-Policy"));
+        assertArrayEquals(content, response.getContentAsByteArray());
+    }
+
+    @Test
+    public void testIsScriptable() {
+        assertTrue(FileTypeUtils.isScriptable("image/svg+xml"));
+        assertTrue(FileTypeUtils.isScriptable("text/html"));
+        assertTrue(FileTypeUtils.isScriptable("application/xhtml+xml"));
+        assertTrue(FileTypeUtils.isScriptable("application/xml"));
+        assertTrue(FileTypeUtils.isScriptable("text/xml"));
+        assertFalse(FileTypeUtils.isScriptable("image/png"));
+        assertFalse(FileTypeUtils.isScriptable("application/pdf"));
+        assertFalse(FileTypeUtils.isScriptable("application/vnd.openxmlformats-officedocument.wordprocessingml.document"));
+        assertFalse(FileTypeUtils.isScriptable(null));
+    }
+
 }
@@ -252,6 +252,28 @@ public class FileServiceImplTest extends BaseDbUnitTest {
     }
     @Test
+    public void testCreateFile_success_fakeExtensionDetectContent() throws Exception {
+        for (String name : new String[]{"图标.xml", "图标.txt"}) {
+            // 准备参数：SVG 内容伪装成其他扩展名
+            byte[] content = "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>"
+                    .getBytes(StandardCharsets.UTF_8);
+            // mock 方法
+            FileClient client = mock(FileClient.class);
+            when(fileConfigService.getMasterFileClient()).thenReturn(client);
+            String url = randomString();
+            when(client.upload(same(content), anyString(), eq("image/svg+xml"))).thenReturn(url);
+
+            // 调用
+            String result = fileService.createFile(content, name, null, "text/plain");
+            // 断言：以内容识别的类型上传，文件存储器据此按附件下载
+            assertEquals(url, result);
+            FileDO file = fileMapper.selectOne(FileDO::getUrl, url);
+            assertEquals(name, file.getName());
+            assertEquals("image/svg+xml", file.getType());
+        }
+    }
+
+    @Test
     public void testCreateFile_success_opus() throws Exception {
         // 准备参数
         byte[] content = new byte[64];