java安全问题_JAVA常见安全问题复现

地址来源于乌云知识库，作者z_zz_zzz

0x01 任意文件下载

web.xml的配置：

DownloadAction

DownloadAction

com.oboi.DownloadAction.DownloadAction

DownloadAction

/DownloadAction

其中的servlet类要换下。类的代码如下：

public class DownloadAction extends HttpServlet {

@Override

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

String rootPath = this.getServletContext().getRealPath("/");

String filename = request.getParameter("filename");

if (filename == null)

filename = "";

filename = filename.trim();

InputStream inStream = null;

byte[] b = new byte[1024];

int len = 0;

try {

if (filename == null) {

return;

}