中危.4.API误用:不安全的框架绑定,缺陷130

whycxzp

2023-10-30 c5765c6e635e8e8aaad020fe70186002aeffc12f

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
package com.whyc.controller;
 
import com.whyc.dto.Response;
import com.whyc.pojo.FGCDFileDownload;
import com.whyc.service.FGCDFileDownloadService;
import com.whyc.util.ActionUtil;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.system.ApplicationHome;
import org.springframework.core.env.Environment;
import org.springframework.web.bind.annotation.*;
 
import javax.servlet.http.HttpServletRequest;
import java.io.File;
import java.util.ArrayList;
import java.util.List;
 
@RestController
@RequestMapping("FGCDFileDownload")
@Api(tags = "在线监测-一体机导入记录")
public class FGCDFileDownloadController extends BaseController{
 
    @Autowired
    private FGCDFileDownloadService service;
    @Autowired
    private Environment environment;
 
    @GetMapping("listByDeviceId")
    @ApiOperation(value = "数据导入")
    public Response<List<FGCDFileDownload>> getListByDeviceId(@RequestParam Integer deviceId){
        List<FGCDFileDownload> downloadList = service.getListByDeviceId(deviceId);
        return new Response<List<FGCDFileDownload>>().set(1,downloadList);
    }
 
    @PostMapping("sendCmdToA059")
    @ApiOperation(value = "终止")
    public Response sendCmdToA059(@RequestParam Integer deviceId){
        boolean cmdCheck = service.sendCmdToA059(deviceId);
        if(cmdCheck){
            return new Response().setII(1, true,null,"停止文件下载成功");
        }
        return new Response().setII(1, false,null,"读取文件失败");
    }
 
    @PutMapping("sendCmdToA059_readFile")
    @ApiOperation(value = "读取设备文件的cmd和ack校验 file_index页码数")
    public Response sendCmdToA059ReadFile(@RequestParam Integer deviceId,@RequestParam Integer fileIndex){
        List cmdCheck = service.sendCmdToA059ReadFile(deviceId, fileIndex);
        if((boolean)cmdCheck.get(0)){
            return new Response().setII(1, true,cmdCheck.get(1),"读取文件成功");
        }
        return new Response().setII(1, false,null,"读取文件超时");
    }
 
    @PutMapping("sendCmdToA059_downloadFile")
    @ApiOperation(value = "导入设备文件的cmd和ack校验 BattGroupId 电池组id，file_index文件对应的索引号")
    public Response sendCmdToA059DownloadFile(@RequestBody FGCDFileDownload download){
        boolean cmdCheck = service.sendCmdToA059DownloadFile(download);
        if(cmdCheck){
            return new Response().setII(1, true,null,"文件开始下载成功");
        }
        return new Response().setII(1, false,null,"文件开始下载失败");
    }
 
    @GetMapping("readA059Pictrue")
    @ApiOperation(tags = "在线监测-实时监控",value = "读取A059内窥镜图片")
    public Response readA059Pictrue(HttpServletRequest request,@RequestParam String devId){
        //过滤特殊字符,避免路径遍历攻击
        devId = ActionUtil.filterFileName(devId);
        /*=========图片保存===========*/
        ApplicationHome applicationHome = new ApplicationHome(getClass());
        File jarFile = applicationHome.getDir();
        //存储A059图片的文件夹
        //调试版
        //D:\GitWorkSpace\fg_v2.0\target\classes
        int configType = Integer.parseInt(environment.getProperty("configFile.type"));
        String fileDirName = "";
        //测试版
        if(configType==1){
            fileDirName = jarFile.getParentFile().toString()+File.separator+"A059"+File.separator+"images"+File.separator+devId;
        }else{
            //打包版
            fileDirName = jarFile.toString()+File.separator+"A059"+File.separator+"images"+File.separator+devId;
        }
 
        //图片的Url
        File file = new File(fileDirName);
        if(file.exists()){
            File[] files = file.listFiles();
            return new Response().set(1,files);
        }else{
            return new Response().set(1,new ArrayList<>());
        }
    }
 
}