路径遍历缺陷8

whycxzp

2023-10-20 5347e1d53f3af597b324e3c420910ed36011c915

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
package com.whyc.controller;
 
import com.whyc.constant.YamlProperties;
import com.whyc.dto.Response;
import com.whyc.util.ActionUtil;
import com.whyc.util.UrlDownload;
import com.whyc.util.Word2PdfJacobUtil;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.springframework.boot.system.ApplicationHome;
import org.springframework.web.bind.annotation.*;
 
import java.io.File;
import java.io.IOException;
import java.net.URLDecoder;
 
@RestController
@RequestMapping("word2Pdf")
@Api(tags = "word转化为pdf")
public class Word2PdfController {
 
    @GetMapping("transfer")
    @ApiOperation(value = "转化")
    public Response transfer(@RequestParam String url,@RequestParam String fileName) throws IOException {
        //过滤特殊字符,避免路径遍历攻击
        fileName = ActionUtil.filterFileName(fileName);
        /*String[] urlSplit = url.split("=");
        String fileUrl = urlSplit[1].replace("&fileName","");
        String fileName = urlSplit[2].split("\\.")[0];*/
        url = URLDecoder.decode(url,"utf-8");
        fileName = URLDecoder.decode(fileName,"utf-8");
        String fileUrl = url;
        String filePath;
        //存储路径
        //项目jar同级目录下,图片能通过http方式访问到,很重要!
        ApplicationHome applicationHome = new ApplicationHome(getClass());
        File jarFile = applicationHome.getDir();
        if(YamlProperties.runModel == 1) {
            //开发路径
            //baseDirPath = jarFile.getParentFile().toString()+File.separator;
            filePath = jarFile.getParentFile().toString()+ File.separator+"fg_photo"+File.separator+"zentao";
            File file = new File(filePath);
            if(!file.exists()){
                file.mkdirs();
            }
        }else {
            //打包路径
            //baseDirPath = jarFile.toString()+File.separator;
            filePath = jarFile.toString()+File.separator+"fg_photo"+File.separator+"zentao";
            File file = new File(filePath);
            if(!file.exists()){
                file.mkdirs();
            }
        }
 
        String suffix = null;
        if(fileName.contains("doc")){
            fileName = fileName.split("\\.docx")[0];
            Word2PdfJacobUtil.word2PDF(fileUrl,filePath+File.separator+fileName+".pdf");
            return new Response().set(1,fileName,"转化成功");
        }
        else if(fileName.contains("xls")){
            suffix = ".xls";
            fileName = fileName.split("\\.xls")[0];
        }
        else if(fileName.contains("pdf")){
            suffix = ".pdf";
            fileName = fileName.split("\\.pdf")[0];
        }
        UrlDownload.downLoadFromUrl(fileUrl,fileName+suffix,filePath);
        return new Response().set(1,fileName+suffix,"保存成功");
    }
 
    public static void main(String[] args) throws IOException {
        String url = "http:%2F%2F118.89.139.230%2Fzentao%2Fdata%2Fupload%2F1%2F202205%2F231425160378826a";
        //String url = "http:%2F%2F118.89.139.230%2Fzentao%2Fdata%2Fupload%2F1%2F202205%2F231425160378826a&fileName=%E6%95%B4%E6%94%B9%E7%BB%86%E8%8A%82v1.xls.xls";
        String fileName = "test.xls";
        String filePath = "F:\\pdf";
        url = URLDecoder.decode(url,"utf-8");
 
        UrlDownload.downLoadFromUrl(url,fileName,filePath);
    }
}