文件上传漏洞
作者: wrndmzmnq创建于 2026年2月10日更新于 2026年2月10日
- The code segment: the upload function in src/main/java/ltd/newbee/mall/controller/common/UploadController.java's upload function
@Controller@RequestMapping("/admin") public class UploadController { @Autowired private StandardServletMultipartResolver standardServletMultipartResolver; @PostMapping({"/admin/upload/file"}) @ResponseBody public Result upload(HttpServletRequest httpServletRequest, @RequestParam("file") MultipartFile file) throws URISyntaxException, IOException { String fileName = file.getOriginalFilename(); BufferedImage bufferedImage = ImageIO.read(file.getInputStream()); if (bufferedImage == null) { return ResultGenerator.genFailResult("Please upload a file of image type"); } String suffixName = fileName.substring(fileName.lastIndexOf(".")); // Generate a file name using a common method SimpleDateFormat sdf = new SimpleDateFormat("yyyyMMdd_HHmmss"); Random r = new Random(); StringBuilder tempName = new StringBuilder(); tempName.append(sdf.format(new Date())).append(r.nextInt(100)).append(suffixName); String newFileName = tempName.toString(); File fileDirectory = new File(Constants.FILE_UPLOAD_DIC); // Create a file try { if (!fileDirectory.exists()) { if (!fileDirectory.mkdir()) { throw new IOException("Directory creation failed, path is:" + fileDirectory); } } file.transferTo(new File(Constants.FILE_UPLOAD_DIC + newFileName)); Result resultSuccess = ResultGenerator.genSuccessResult(); resultSuccess.setData(NewBeeMallUtils.getHost(new URI(httpServletRequest.getRequestURL() + "")) + "/upload/" + newFileName); return resultSuccess; } catch (IOException e) { e.printStackTrace(); return ResultGenerator.genFailResult("File upload failed"); } } } 2. No validation of file extensions is performed. 3. The frontend validates whether the file format is JPG, PNG, or GIF
内容来源: newbee-ltd/newbee-mall