fix(mp): 修复公众号素材上传临时文件覆盖问题

YunaiV
1 parent 5db1c511
Showing 2 changed files with 298 additions and 3 deletions
yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java
yudao-module-mp/src/test/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImplTest.java
@@ -3,6 +3,7 @@ package cn.iocoder.yudao.module.mp.service.material;
 import cn.hutool.core.io.FileTypeUtil;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.ObjUtil;
+import cn.hutool.core.util.ReUtil;
 import cn.hutool.core.util.StrUtil;
 import cn.iocoder.yudao.framework.common.pojo.PageResult;
 import cn.iocoder.yudao.module.infra.api.file.FileApi;
@@ -16,6 +17,7 @@ import cn.iocoder.yudao.module.mp.dal.dataobject.material.MpMaterialDO;
 import cn.iocoder.yudao.module.mp.dal.mysql.material.MpMaterialMapper;
 import cn.iocoder.yudao.module.mp.framework.mp.core.MpServiceFactory;
 import cn.iocoder.yudao.module.mp.service.account.MpAccountService;
+import com.google.common.annotations.VisibleForTesting;
 import lombok.extern.slf4j.Slf4j;
 import me.chanjar.weixin.common.bean.result.WxMediaUploadResult;
 import me.chanjar.weixin.common.error.WxErrorException;
@@ -24,12 +26,15 @@ import me.chanjar.weixin.mp.bean.material.WxMpMaterialUploadResult;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.stereotype.Service;
 import org.springframework.validation.annotation.Validated;
+import org.springframework.web.multipart.MultipartFile;
 import jakarta.annotation.Resource;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Collection;
 import java.util.List;
+import java.util.regex.Pattern;
 import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static cn.iocoder.yudao.module.mp.enums.ErrorCodeConstants.*;
@@ -44,6 +49,15 @@ import static cn.iocoder.yudao.module.mp.enums.ErrorCodeConstants.*;
 @Slf4j
 public class MpMaterialServiceImpl implements MpMaterialService {
+    /**
+     * 临时文件的前缀
+     */
+    private static final String TEMP_FILE_PREFIX = "mp-material-";
+    /**
+     * 临时文件允许保留的扩展名格式
+     */
+    private static final Pattern TEMP_FILE_EXTENSION_PATTERN = Pattern.compile("^[a-zA-Z0-9]{1,16}$");
+
     @Resource
     private MpMaterialMapper mpMaterialMapper;
@@ -90,7 +104,7 @@ public class MpMaterialServiceImpl implements MpMaterialService {
         String url;
         try {
             // 写入到临时文件
-            file = FileUtil.newFile(FileUtil.getTmpDirPath() + reqVO.getFile().getOriginalFilename());
+            file = createTempFile(reqVO.getFile());
             reqVO.getFile().transferTo(file);
             // 上传到公众号
             result = mpService.getMaterialService().mediaUpload(reqVO.getType(), file);
@@ -122,7 +136,7 @@ public class MpMaterialServiceImpl implements MpMaterialService {
         String url;
         try {
             // 写入到临时文件
-            file = FileUtil.newFile(FileUtil.getTmpDirPath() + reqVO.getFile().getOriginalFilename());
+            file = createTempFile(reqVO.getFile());
             reqVO.getFile().transferTo(file);
             // 上传到公众号
             result = mpService.getMaterialService().materialFileUpload(reqVO.getType(),
@@ -150,7 +164,7 @@ public class MpMaterialServiceImpl implements MpMaterialService {
         File file = null;
         try {
             // 写入到临时文件
-            file = FileUtil.newFile(FileUtil.getTmpDirPath() + reqVO.getFile().getOriginalFilename());
+            file = createTempFile(reqVO.getFile());
             reqVO.getFile().transferTo(file);
             // 上传到公众号
             return mpService.getMaterialService().mediaImgUpload(file).getUrl();
@@ -221,4 +235,20 @@ public class MpMaterialServiceImpl implements MpMaterialService {
         return fileApi.createFile(FileUtil.readBytes(file), path);
     }
+    /**
+     * 创建上传到公众号的临时文件
+     *
+     * 使用随机的文件名独占创建，不拼接原始文件名，避免目录穿越覆盖、删除其它文件，以及并发同名互相影响；
+     * 仅保留合法的扩展名，用于公众号识别文件类型
+     *
+     * @param file 上传的文件
+     * @return 临时文件
+     */
+    @VisibleForTesting
+    static File createTempFile(MultipartFile file) throws IOException {
+        String extension = FileUtil.extName(file.getOriginalFilename());
+        String suffix = ReUtil.isMatch(TEMP_FILE_EXTENSION_PATTERN, extension) ? StrUtil.DOT + extension : null;
+        return Files.createTempFile(TEMP_FILE_PREFIX, suffix).toFile();
+    }
+
 }
+package cn.iocoder.yudao.module.mp.service.material;
+
+import cn.hutool.core.io.FileUtil;
+import cn.hutool.core.util.IdUtil;
+import cn.iocoder.yudao.framework.test.core.ut.BaseMockitoUnitTest;
+import cn.iocoder.yudao.module.infra.api.file.FileApi;
+import cn.iocoder.yudao.module.mp.controller.admin.material.vo.MpMaterialUploadNewsImageReqVO;
+import cn.iocoder.yudao.module.mp.controller.admin.material.vo.MpMaterialUploadPermanentReqVO;
+import cn.iocoder.yudao.module.mp.controller.admin.material.vo.MpMaterialUploadTemporaryReqVO;
+import cn.iocoder.yudao.module.mp.dal.dataobject.account.MpAccountDO;
+import cn.iocoder.yudao.module.mp.dal.mysql.material.MpMaterialMapper;
+import cn.iocoder.yudao.module.mp.framework.mp.core.MpServiceFactory;
+import cn.iocoder.yudao.module.mp.service.account.MpAccountService;
+import me.chanjar.weixin.common.bean.result.WxMediaUploadResult;
+import me.chanjar.weixin.common.error.WxError;
+import me.chanjar.weixin.common.error.WxErrorException;
+import me.chanjar.weixin.mp.api.WxMpMaterialService;
+import me.chanjar.weixin.mp.api.WxMpService;
+import me.chanjar.weixin.mp.bean.material.WxMediaImgUploadResult;
+import me.chanjar.weixin.mp.bean.material.WxMpMaterial;
+import me.chanjar.weixin.mp.bean.material.WxMpMaterialUploadResult;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.springframework.mock.web.MockMultipartFile;
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+
+import static cn.iocoder.yudao.framework.test.core.util.AssertUtils.assertServiceException;
+import static cn.iocoder.yudao.module.mp.enums.ErrorCodeConstants.MATERIAL_UPLOAD_FAIL;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+/**
+ * {@link MpMaterialServiceImpl} 的单元测试
+ *
+ * @author 芋道源码
+ */
+public class MpMaterialServiceImplTest extends BaseMockitoUnitTest {
+
+    @InjectMocks
+    private MpMaterialServiceImpl materialService;
+
+    @Mock
+    private MpMaterialMapper mpMaterialMapper;
+    @Mock
+    private FileApi fileApi;
+    @Mock
+    private MpAccountService mpAccountService;
+    @Mock
+    private MpServiceFactory mpServiceFactory;
+
+    @Mock
+    private WxMpService mpService;
+    @Mock
+    private WxMpMaterialService mpMaterialService;
+
+    /**
+     * 模拟系统临时目录中，与上传原始文件名相同的其它文件
+     */
+    private File victimFile;
+
+    @BeforeEach
+    public void setUp() {
+        victimFile = FileUtil.writeUtf8String("victim", new File(FileUtil.getTmpDir(), IdUtil.fastSimpleUUID() + ".jpg"));
+    }
+
+    @AfterEach
+    public void tearDown() {
+        FileUtil.del(victimFile);
+    }
+
+    @Test
+    public void testUploadTemporaryMaterial_originalFilenameNotUsed() throws Exception {
+        // 准备参数：原始文件名与临时目录中的其它文件同名
+        MpMaterialUploadTemporaryReqVO reqVO = new MpMaterialUploadTemporaryReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setType("image");
+        reqVO.setFile(buildMultipartFile(victimFile.getName()));
+        // mock 方法
+        mockMpService();
+        mockUploadFile();
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.mediaUpload(eq("image"), any(File.class))).thenAnswer(invocation -> {
+            File file = invocation.getArgument(1);
+            assertTempFile(file, ".jpg");
+            uploadFiles.add(file);
+            return buildMediaUploadResult();
+        });
+
+        // 调用
+        materialService.uploadTemporaryMaterial(reqVO);
+        // 断言：同名文件未被覆盖、删除；临时文件已清理
+        assertEquals(1, uploadFiles.size());
+        assertTrue(victimFile.exists());
+        assertEquals("victim", FileUtil.readUtf8String(victimFile));
+        assertFalse(uploadFiles.get(0).exists());
+    }
+
+    @Test
+    public void testUploadTemporaryMaterial_traversalFilename() throws Exception {
+        // 准备参数：原始文件名包含目录穿越与绝对路径
+        MpMaterialUploadTemporaryReqVO reqVO = new MpMaterialUploadTemporaryReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setType("image");
+        reqVO.setFile(buildMultipartFile("../../" + victimFile.getAbsolutePath()));
+        // mock 方法
+        mockMpService();
+        mockUploadFile();
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.mediaUpload(eq("image"), any(File.class))).thenAnswer(invocation -> {
+            File file = invocation.getArgument(1);
+            assertTempFile(file, ".jpg");
+            uploadFiles.add(file);
+            return buildMediaUploadResult();
+        });
+
+        // 调用
+        materialService.uploadTemporaryMaterial(reqVO);
+        // 断言
+        assertEquals("victim", FileUtil.readUtf8String(victimFile));
+        assertFalse(uploadFiles.get(0).exists());
+    }
+
+    @Test
+    public void testUploadTemporaryMaterial_sameFilenameConcurrent() throws Exception {
+        // 准备参数：两次上传相同的原始文件名
+        MpMaterialUploadTemporaryReqVO reqVO = new MpMaterialUploadTemporaryReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setType("image");
+        reqVO.setFile(buildMultipartFile("same.jpg"));
+        // mock 方法
+        mockMpService();
+        mockUploadFile();
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.mediaUpload(eq("image"), any(File.class))).thenAnswer(invocation -> {
+            File file = invocation.getArgument(1);
+            assertTempFile(file, ".jpg");
+            uploadFiles.add(file);
+            return buildMediaUploadResult();
+        });
+
+        // 调用
+        materialService.uploadTemporaryMaterial(reqVO);
+        materialService.uploadTemporaryMaterial(reqVO);
+        // 断言：每次都是独立的临时文件
+        assertEquals(2, uploadFiles.size());
+        assertNotEquals(uploadFiles.get(0).getAbsolutePath(), uploadFiles.get(1).getAbsolutePath());
+    }
+
+    @Test
+    public void testUploadTemporaryMaterial_wxError() throws Exception {
+        // 准备参数
+        MpMaterialUploadTemporaryReqVO reqVO = new MpMaterialUploadTemporaryReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setType("image");
+        reqVO.setFile(buildMultipartFile(victimFile.getName()));
+        // mock 方法
+        mockMpService();
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.mediaUpload(eq("image"), any(File.class))).thenAnswer(invocation -> {
+            uploadFiles.add(invocation.getArgument(1));
+            throw new WxErrorException(WxError.builder().errorCode(40001).errorMsg("invalid").build());
+        });
+
+        // 调用，并断言异常
+        assertServiceException(() -> materialService.uploadTemporaryMaterial(reqVO), MATERIAL_UPLOAD_FAIL, "invalid");
+        // 断言：失败时，也只清理自己创建的临时文件
+        assertFalse(uploadFiles.get(0).exists());
+        assertEquals("victim", FileUtil.readUtf8String(victimFile));
+    }
+
+    @Test
+    public void testUploadPermanentMaterial_originalFilenameNotUsed() throws Exception {
+        // 准备参数
+        MpMaterialUploadPermanentReqVO reqVO = new MpMaterialUploadPermanentReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setType("image");
+        reqVO.setName("永久素材");
+        reqVO.setFile(buildMultipartFile(victimFile.getName()));
+        // mock 方法
+        mockMpService();
+        mockUploadFile();
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.materialFileUpload(eq("image"), any(WxMpMaterial.class))).thenAnswer(invocation -> {
+            WxMpMaterial material = invocation.getArgument(1);
+            assertTempFile(material.getFile(), ".jpg");
+            uploadFiles.add(material.getFile());
+            WxMpMaterialUploadResult result = new WxMpMaterialUploadResult();
+            result.setMediaId("media_02");
+            return result;
+        });
+
+        // 调用
+        materialService.uploadPermanentMaterial(reqVO);
+        // 断言
+        assertEquals("victim", FileUtil.readUtf8String(victimFile));
+        assertFalse(uploadFiles.get(0).exists());
+    }
+
+    @Test
+    public void testUploadNewsImage_originalFilenameNotUsed() throws Exception {
+        // 准备参数：扩展名不合法时，不保留扩展名
+        MpMaterialUploadNewsImageReqVO reqVO = new MpMaterialUploadNewsImageReqVO();
+        reqVO.setAccountId(1L);
+        reqVO.setFile(buildMultipartFile(victimFile.getName() + ".p%ng"));
+        // mock 方法
+        when(mpServiceFactory.getRequiredMpService(eq(1L))).thenReturn(mpService);
+        when(mpService.getMaterialService()).thenReturn(mpMaterialService);
+        List<File> uploadFiles = new ArrayList<>();
+        when(mpMaterialService.mediaImgUpload(any(File.class))).thenAnswer(invocation -> {
+            File file = invocation.getArgument(0);
+            assertTempFile(file, ".tmp");
+            uploadFiles.add(file);
+            WxMediaImgUploadResult result = new WxMediaImgUploadResult();
+            result.setUrl("https://mmbiz.qpic.cn/test.jpg");
+            return result;
+        });
+
+        // 调用
+        String url = materialService.uploadNewsImage(reqVO);
+        // 断言
+        assertEquals("https://mmbiz.qpic.cn/test.jpg", url);
+        assertEquals("victim", FileUtil.readUtf8String(victimFile));
+        assertFalse(uploadFiles.get(0).exists());
+    }
+
+    private void mockMpService() {
+        when(mpServiceFactory.getRequiredMpService(eq(1L))).thenReturn(mpService);
+        when(mpService.getMaterialService()).thenReturn(mpMaterialService);
+    }
+
+    private void mockUploadFile() {
+        when(fileApi.createFile(any(byte[].class), anyString())).thenReturn("https://www.iocoder.cn/media.jpg");
+        when(mpAccountService.getRequiredAccount(eq(1L))).thenReturn(new MpAccountDO().setId(1L).setAppId("wx_app"));
+    }
+
+    private static WxMediaUploadResult buildMediaUploadResult() {
+        WxMediaUploadResult result = new WxMediaUploadResult();
+        result.setMediaId("media_01");
+        return result;
+    }
+
+    private static MockMultipartFile buildMultipartFile(String originalFilename) {
+        return new MockMultipartFile("file", originalFilename, "image/jpeg",
+                "content".getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static void assertTempFile(File file, String suffix) throws Exception {
+        assertTrue(file.exists());
+        assertEquals(FileUtil.getTmpDir().getCanonicalFile(), file.getParentFile().getCanonicalFile());
+        assertTrue(file.getName().startsWith("mp-material-"));
+        assertTrue(file.getName().endsWith(suffix));
+        assertEquals("content", FileUtil.readUtf8String(file));
+    }
+
+}