Skip to content

[feat-1202][taier-data-develop] check with upLoadController getResourceFromFiles file path #1202 #1206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zcswl7961 merged 1 commit into from
Jul 21, 2026
+36 −6
Merged

[feat-1202][taier-data-develop] check with upLoadController getResourceFromFiles file path #1202 #1206

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 36 additions & 6 deletions ...-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@

import javax.validation.constraints.NotNull;
import java.io.File;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

Expand All @@ -57,6 +58,8 @@ public class UploadController {

private static String uploadsDir = System.getProperty("user.dir") + File.separator + "file-uploads";

private static final String INVALID_UPLOAD_FILE_NAME = "Invalid upload file name";

@PostMapping(value="/component/config")
@ApiOperation(value = "解析zip中xml或者json")
public R<List<Object>> upload(@RequestParam("fileName") List<MultipartFile> files, @RequestParam("componentType") Integer componentType,
Expand Down Expand Up @@ -144,19 +147,46 @@ private List<Resource> getResourcesFromFiles(List<MultipartFile> files) {
List<Resource> resources = new ArrayList<>(files.size());
for (MultipartFile file : files) {
String fileOriginalName = file.getOriginalFilename();
String path = uploadsDir + File.separator + fileOriginalName;
File saveFile = new File(path);
if (!saveFile.getParentFile().exists()) {
saveFile.getParentFile().mkdirs();
}
String safeFileName = checkAndGetSafeFileName(fileOriginalName);
File saveFile = buildUploadFile(safeFileName);
try {
file.transferTo(saveFile);
} catch (Exception e) {
LOGGER.error("" , e);
throw new TaierDefineException("An error occurred while storing the file");
}
resources.add(new Resource(fileOriginalName, path, (int) file.getSize(), file.getContentType(), file.getName()));
resources.add(new Resource(fileOriginalName, saveFile.getPath(), (int) file.getSize(), file.getContentType(), file.getName()));
}
return resources;
}

private String checkAndGetSafeFileName(String fileOriginalName) {
if (StringUtils.isBlank(fileOriginalName)
|| fileOriginalName.contains("/")
|| fileOriginalName.contains("\\")
|| fileOriginalName.contains("..")
|| new File(fileOriginalName).isAbsolute()) {
throw new TaierDefineException(INVALID_UPLOAD_FILE_NAME);
}
return fileOriginalName;
}

private File buildUploadFile(String safeFileName) {
try {
File uploadBaseDir = new File(uploadsDir);
if (!uploadBaseDir.exists() && !uploadBaseDir.mkdirs()) {
throw new TaierDefineException("An error occurred while storing the file");
}
File saveFile = new File(uploadBaseDir, safeFileName);
String uploadBasePath = uploadBaseDir.getCanonicalPath();
String saveFilePath = saveFile.getCanonicalPath();
if (!saveFilePath.startsWith(uploadBasePath + File.separator)) {
throw new TaierDefineException(INVALID_UPLOAD_FILE_NAME);
}
return saveFile;
} catch (IOException e) {
LOGGER.error("Build upload file failed", e);
throw new TaierDefineException("An error occurred while storing the file");
}
}
}
Loading