yexuejc007/PlayEdu
1
0
Fork 0
mirror of https://github.com/PlayEdu/PlayEdu synced 2025-06-25 14:22:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

优化图片上传的安全判断

Browse Source
This commit is contained in:
none 2023-03-09 10:14:39 +08:00
parent da74e6425d
commit 4a012afaea
2 changed files with 8 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/java/xyz/playedu/api/controller/backend/UploadController.java
View File

@ -36,8 +36,8 @@ public class UploadController {
@Autowired @Autowired
private ResourceService resourceService; private ResourceService resourceService;
@PostMapping("/file") @PostMapping("/minio")
public JsonResponse file(@RequestParam HashMap<String, Object> params, MultipartFile file) throws ServiceException { public JsonResponse uploadMinio(@RequestParam HashMap<String, Object> params, MultipartFile file) throws ServiceException {
String categoryIds = MapUtils.getString(params, "category_ids"); String categoryIds = MapUtils.getString(params, "category_ids");
Resource res = uploadService.storeMinio(file, categoryIds); Resource res = uploadService.storeMinio(file, categoryIds);
return JsonResponse.data(res); return JsonResponse.data(res);

21
src/main/java/xyz/playedu/api/service/impl/UploadServiceImpl.java
View File

@ -41,14 +41,7 @@ public class UploadServiceImpl implements UploadService {
String ext = HelperUtil.fileExt(filename); String ext = HelperUtil.fileExt(filename);
String type = BackendConstant.RESOURCE_EXT_2_TYPE.get(ext); String type = BackendConstant.RESOURCE_EXT_2_TYPE.get(ext);
if (type == null) { if (type == null) {
throw new ServiceException("格式不支持"); throw new ServiceException("当前资源扩展不支持上传");
}
// content-type校验
String contentType = file.getContentType();
String safeContentType = BackendConstant.RESOURCE_EXT_2_CONTENT_TYPE.get(ext);
if (safeContentType == null || !safeContentType.equals(contentType)) {
throw new ServiceException("格式不支持");
} }
// 上传原文件的文件名 // 上传原文件的文件名
@ -58,7 +51,7 @@ public class UploadServiceImpl implements UploadService {
String savePath = BackendConstant.RESOURCE_TYPE_2_DIR.get(type) + newFilename; String savePath = BackendConstant.RESOURCE_TYPE_2_DIR.get(type) + newFilename;
// 保存文件 // 保存文件
String url = minioService.saveFile(file, savePath, contentType); String url = minioService.saveFile(file, savePath, BackendConstant.RESOURCE_EXT_2_CONTENT_TYPE.get(ext));
// 上传记录 // 上传记录
return resourceService.create(categoryIds, type, oFilename, ext, file.getSize(), BackendConstant.STORAGE_DRIVER_MINIO, "", savePath, url); return resourceService.create(categoryIds, type, oFilename, ext, file.getSize(), BackendConstant.STORAGE_DRIVER_MINIO, "", savePath, url);
} }
@ -73,11 +66,9 @@ public class UploadServiceImpl implements UploadService {
String ext = contentType.replaceAll("image/", ""); String ext = contentType.replaceAll("image/", "");
// 通过文件格式解析资源类型 // 通过文件格式解析资源类型
String type = BackendConstant.RESOURCE_EXT_2_TYPE.get(ext); String type = BackendConstant.RESOURCE_EXT_2_TYPE.get(ext);
// 通过资源类型获取安全的content-type // 资源类型必须存在
String safeContentType = BackendConstant.RESOURCE_EXT_2_CONTENT_TYPE.get(ext); if (type == null) {
// 资源类型必须存在 && 安全的 content-type 必须存在 且与解析出来的 content-type 一致 throw new ServiceException("资源类型不支持");
if (type == null || safeContentType == null || !safeContentType.equals(contentType)) {
throw new ServiceException("格式不支持");
} }
byte[] binary = Base64Util.decode(base64Rows[1]); byte[] binary = Base64Util.decode(base64Rows[1]);
@ -85,7 +76,7 @@ public class UploadServiceImpl implements UploadService {
String savePath = BackendConstant.RESOURCE_TYPE_2_DIR.get(type) + filename; String savePath = BackendConstant.RESOURCE_TYPE_2_DIR.get(type) + filename;
// 保存文件 // 保存文件
String url = minioService.saveBytes(binary, savePath, contentType); String url = minioService.saveBytes(binary, savePath, BackendConstant.RESOURCE_EXT_2_CONTENT_TYPE.get(ext));
// 上传记录 // 上传记录
return resourceService.create(categoryIds, type, filename, ext, (long) binary.length, BackendConstant.STORAGE_DRIVER_MINIO, "", savePath, url); return resourceService.create(categoryIds, type, filename, ext, (long) binary.length, BackendConstant.STORAGE_DRIVER_MINIO, "", savePath, url);
} }