gfwleak/k18-ntcs-web-ntc
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

文件上传intercepter中，如果是修改，对为修改的文件不做校验

Browse Source
This commit is contained in:
duandongmei
2018-07-13 14:29:38 +08:00
parent 317d0ff9d7
commit 47dd011c3c
1 changed files with 70 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
src/main/java/com/nis/interceptor/MultipartFileIntercepter.java
View File

@@ -5,11 +5,16 @@ import static java.lang.String.format;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.io.UnsupportedEncodingException;
import java.nio.charset.Charset;
import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map;
import java.util.Properties; import java.util.Properties;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import org.apache.commons.fileupload.FileItem;
import org.apache.commons.fileupload.FileUpload; import org.apache.commons.fileupload.FileUpload;
import org.apache.commons.fileupload.FileUploadBase; import org.apache.commons.fileupload.FileUploadBase;
import org.apache.commons.fileupload.FileUploadException; import org.apache.commons.fileupload.FileUploadException;
@@ -19,10 +24,14 @@ import org.apache.commons.fileupload.servlet.ServletFileUpload;
import org.apache.commons.fileupload.servlet.ServletRequestContext; import org.apache.commons.fileupload.servlet.ServletRequestContext;
import org.apache.log4j.Logger; import org.apache.log4j.Logger;
import org.springframework.context.i18n.LocaleContextHolder; import org.springframework.context.i18n.LocaleContextHolder;
import org.springframework.http.MediaType;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap; import org.springframework.util.MultiValueMap;
import org.springframework.util.StringUtils;
import org.springframework.web.multipart.MultipartException; import org.springframework.web.multipart.MultipartException;
import org.springframework.web.multipart.MultipartFile; import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.multipart.commons.CommonsFileUploadSupport; import org.springframework.web.multipart.commons.CommonsFileUploadSupport;
import org.springframework.web.multipart.commons.CommonsMultipartFile;
import org.springframework.web.multipart.commons.CommonsMultipartResolver; import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import com.nis.exceptions.MultiPartNewException; import com.nis.exceptions.MultiPartNewException;
@@ -48,7 +57,6 @@ public class MultipartFileIntercepter extends CommonsMultipartResolver{
if(isSampleFileUpload || isDigestFileUpload){ if(isSampleFileUpload || isDigestFileUpload){
/*****************预先获取上传文件的总的大小************/ /*****************预先获取上传文件的总的大小************/
FileUpload fileUploadTotal = fileUpload; FileUpload fileUploadTotal = fileUpload;
ServletRequestContext ctx = new ServletRequestContext(request); ServletRequestContext ctx = new ServletRequestContext(request);
InputStream input=ctx.getInputStream(); InputStream input=ctx.getInputStream();
@SuppressWarnings("deprecation") // still has to be backward compatible @SuppressWarnings("deprecation") // still has to be backward compatible
@@ -166,5 +174,66 @@ public class MultipartFileIntercepter extends CommonsMultipartResolver{
} }
return msgProp; return msgProp;
} }
protected CommonsFileUploadSupport.MultipartParsingResult parseFileItems(List<FileItem> fileItems, String encoding) {
MultiValueMap<String, MultipartFile> multipartFiles = new LinkedMultiValueMap<String, MultipartFile>();
Map<String, String[]> multipartParameters = new HashMap<String, String[]>();
Map<String, String> multipartParameterContentTypes = new HashMap<String, String>();
// Extract multipart files and multipart parameters.
for (FileItem fileItem : fileItems) {
if (fileItem.isFormField()) {
String value;
String partEncoding = determineEncoding(fileItem.getContentType(), encoding);
if (partEncoding != null) {
try {
value = fileItem.getString(partEncoding);
}
catch (UnsupportedEncodingException ex) {
if (logger.isDebugEnabled()) {
logger.warn("Could not decode multipart item '" + fileItem.getFieldName() +
"' with encoding '" + partEncoding + "': using platform default");
}
value = fileItem.getString();
}
}
else {
value = fileItem.getString();
}
String[] curParam = multipartParameters.get(fileItem.getFieldName());
if (curParam == null) {
// simple form field
multipartParameters.put(fileItem.getFieldName(), new String[] {value});
}
else {
// array of simple form fields
String[] newParam = StringUtils.addStringToArray(curParam, value);
multipartParameters.put(fileItem.getFieldName(), newParam);
}
multipartParameterContentTypes.put(fileItem.getFieldName(), fileItem.getContentType());
}
else {
// multipart file field
CommonsMultipartFile file = new CommonsMultipartFile(fileItem);
if(!StringUtils.isEmpty(file.getOriginalFilename())){
multipartFiles.add(file.getName(), file);
}
if (logger.isDebugEnabled()) {
logger.debug("Found multipart file [" + file.getName() + "] of size " + file.getSize() +
" bytes with original filename [" + file.getOriginalFilename() + "], stored " +
file.getStorageDescription());
}
}
}
return new MultipartParsingResult(multipartFiles, multipartParameters, multipartParameterContentTypes);
}
private String determineEncoding(String contentTypeHeader, String defaultEncoding) {
if (!StringUtils.hasText(contentTypeHeader)) {
return defaultEncoding;
}
MediaType contentType = MediaType.parseMediaType(contentTypeHeader);
Charset charset = contentType.getCharSet();
return (charset != null ? charset.name() : defaultEncoding);
}
} }