tangweijie/xlcp-backend
1
0
Fork 0
Code Issues 5 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(infra): 文件上传时，放宽 directory 校验，可支持类似 XXX/YYY 目录

Browse Source
This commit is contained in:
YunaiV 2025-12-13 09:39:30 +08:00
parent 04e59b0561
commit be27ba3aa6
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/vo/file/FileUploadReqVO.java
View File

@ -22,7 +22,14 @@ public class FileUploadReqVO {
@AssertTrue(message = "文件目录不正确") @AssertTrue(message = "文件目录不正确")
@JsonIgnore @JsonIgnore
public boolean isDirectoryValid() { public boolean isDirectoryValid() {
return !StrUtil.containsAny(directory, "..", "/", "\\"); return isDirectoryValid(directory);
}
public static boolean isDirectoryValid(String directory) {
// 1. 不能包含 .. 防止目录穿越
// 2. 不能以 / 或 \ 开头，防止上传到根目录
return !StrUtil.contains(directory, "..")
&& !StrUtil.startWithAny(directory, "/", "\\");
} }
} }

4
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/app/file/vo/AppFileUploadReqVO.java
View File

@ -1,6 +1,6 @@
package cn.iocoder.yudao.module.infra.controller.app.file.vo; package cn.iocoder.yudao.module.infra.controller.app.file.vo;
import cn.hutool.core.util.StrUtil; import cn.iocoder.yudao.module.infra.controller.admin.file.vo.file.FileUploadReqVO;
import com.fasterxml.jackson.annotation.JsonIgnore; import com.fasterxml.jackson.annotation.JsonIgnore;
import io.swagger.v3.oas.annotations.media.Schema; import io.swagger.v3.oas.annotations.media.Schema;
import jakarta.validation.constraints.AssertTrue; import jakarta.validation.constraints.AssertTrue;
@ -22,7 +22,7 @@ public class AppFileUploadReqVO {
@AssertTrue(message = "文件目录不正确") @AssertTrue(message = "文件目录不正确")
@JsonIgnore @JsonIgnore
public boolean isDirectoryValid() { public boolean isDirectoryValid() {
return !StrUtil.containsAny(directory, "..", "/", "\\"); return FileUploadReqVO.isDirectoryValid(directory);
} }
} }