java审计-文件上传

介绍

enctype属性值

• application/x-www-form-urlencoded：默认编码方式，只处理表单中的value属性值，这种编码方式会将表单中的值处理成URL编码方式
• multipart/form-data：以二进制流的方式处理表单数据，会把文件内容也封装到请求参数中，不会对字符编码
• text/plain：把空格转换为+ ，当表单action属性为mailto:URL形式时比较方便，适用于直接通过表单发送邮件方式

任何上传

// uplaod any file
@GetMapping("/any")
public String index() {
    return "upload"; // return upload.html page
}
@PostMapping("/upload")
public String singleFileUpload(@RequestParam("file") MultipartFile file,
                               RedirectAttributes redirectAttributes) {
    if (file.isEmpty()) {
        // 赋值给uploadStatus.html里的动态参数message
        redirectAttributes.addFlashAttribute("message", "Please select a file to upload");
        return "redirect:/file/status";
    }

    try {
        // Get the file and save it somewhere
        byte[] bytes = file.getBytes();
        Path path = Paths.get(UPLOADED_FOLDER + file.getOriginalFilename());
        Files.write(path, bytes);

        redirectAttributes.addFlashAttribute("message",
                "You successfully uploaded '" + UPLOADED_FOLDER + file.getOriginalFilename() + "'");

    } catch (IOException e) {
        redirectAttributes.addFlashAttribute("message", "upload failed");
        logger.error(e.toString());
    }

    return "redirect:/file/status";
}

修复

后缀名过滤

// 判断文件后缀名是否在白名单内
String[] picSuffixList = {".jpg", ".png", ".jpeg", ".gif", ".bmp", ".ico"};
boolean suffixFlag = false;
for (String white_suffix : picSuffixList) {
	if (Suffix.toLowerCase().equals(white_suffix)) {
		suffixFlag = true;
		break;
	}
}

MIME过滤

• 对MIME类型进行了黑名单限制，不过这个可以进行抓包修改绕过

// 判断MIME类型是否在黑名单内
String[] mimeTypeBlackList = {
		"text/html",
		"text/javascript",
		"application/javascript",
		"application/ecmascript",
		"text/xml",
		"application/xml"
};
for (String blackMimeType : mimeTypeBlackList) {
	// 用contains是为了防止text/html;charset=UTF-8绕过
	if (SecurityUtil.replaceSpecialStr(mimeType).toLowerCase().contains(blackMimeType)) {
		logger.error("[-] Mime type error: " + mimeType);
		//deleteFile(filePath);
		return "Upload failed. Illeagl picture.";
	}
}

路径穿越过滤

• 文件保存的时候路径是通过 来获取，Path path =excelFile.toPath();就避免了路径穿越的实现

File excelFile = convert(multifile);//文件名字做了uuid处理
String filePath = excelFile.getPath();
// 判断文件内容是否是图片 校验3
boolean isImageFlag = isImage(excelFile);
if (!isImageFlag) {
	logger.error("[-] File is not Image");
	deleteFile(filePath);
	return "Upload failed. Illeagl picture.";
}

对上传的文件过滤

• 判断上传的文件是否为图片，通过ImageIO.read对文件进行读取来判断

private static boolean isImage(File file) throws
IOException {
BufferedImage bi = ImageIO.read(file);
return bi != null;
}

任意文件读取/下载

@WebServlet("/FileRead")
public class FileRead extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //以当前get请求的路径+filename参数值作为File对象
        File file = new File(this.getServletContext().getRealPath("/") + req.getParameter("filename"));
        FileInputStream in = new FileInputStream(file);
        ServletOutputStream sos = resp.getOutputStream();
        int len;
        byte[] buffer = new byte[1024];

        while ((len = in.read(buffer)) != -1) {
            sos.write(buffer, 0, len);
        }
        in.close();
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doGet(req, resp);
    }
}