fix(infra): 文件上传时，放宽 directory 校验，可支持类似 XXX/YYY 目录

YunaiV
1 parent 04e59b05
Showing 2 changed files with 10 additions and 3 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/vo/file/FileUploadReqVO.java
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/app/file/vo/AppFileUploadReqVO.java
@@ -22,7 +22,14 @@ public class FileUploadReqVO {
     @AssertTrue(message = "文件目录不正确")
     @JsonIgnore
     public boolean isDirectoryValid() {
-        return !StrUtil.containsAny(directory, "..", "/", "\\");
+        return isDirectoryValid(directory);
+    }
+
+    public static boolean isDirectoryValid(String directory) {
+        // 1. 不能包含 .. 防止目录穿越
+        // 2. 不能以 / 或 \ 开头，防止上传到根目录
+        return !StrUtil.contains(directory, "..")
+                && !StrUtil.startWithAny(directory, "/", "\\");
     }
 }
 package cn.iocoder.yudao.module.infra.controller.app.file.vo;
-import cn.hutool.core.util.StrUtil;
+import cn.iocoder.yudao.module.infra.controller.admin.file.vo.file.FileUploadReqVO;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.AssertTrue;
@@ -22,7 +22,7 @@ public class AppFileUploadReqVO {
     @AssertTrue(message = "文件目录不正确")
     @JsonIgnore
     public boolean isDirectoryValid() {
-        return !StrUtil.containsAny(directory, "..", "/", "\\");
+        return FileUploadReqVO.isDirectoryValid(directory);
     }
 }