|
15 | 15 | import java.nio.file.attribute.BasicFileAttributes; |
16 | 16 | import java.util.ArrayList; |
17 | 17 | import java.util.Arrays; |
| 18 | +import java.util.Collection; |
18 | 19 | import java.util.Collections; |
19 | 20 | import java.util.Comparator; |
20 | 21 | import java.util.Date; |
|
25 | 26 | import org.apache.commons.io.FileUtils; |
26 | 27 | import org.apache.commons.io.IOUtils; |
27 | 28 | import org.apache.commons.lang3.ArrayUtils; |
| 29 | +import org.apache.pdfbox.cos.COSArray; |
28 | 30 | import org.apache.pdfbox.cos.COSBase; |
29 | 31 | import org.apache.pdfbox.cos.COSDictionary; |
30 | 32 | import org.apache.pdfbox.cos.COSName; |
@@ -83,28 +85,34 @@ private CmsFileUtils() { |
83 | 85 | /** |
84 | 86 | * |
85 | 87 | */ |
86 | | - public static final String[] DOCUMENT_FILE_SUFFIXS = new String[] { ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".pdf", ".txt", ".md", ".ofd" }; |
| 88 | + public static final String[] DOCUMENT_FILE_SUFFIXS = new String[] { ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".pdf", |
| 89 | + ".txt", ".md", ".ofd" }; |
87 | 90 | /** |
88 | 91 | * |
89 | 92 | */ |
90 | | - public static final String[] VIDEO_FILE_SUFFIXS = new String[] { ".flv", ".swf", ".mkv", ".avi", ".rm", ".rmvb", ".mpeg", ".mpg", ".ogg", ".ogv", ".mov", ".wmv", ".mp4", ".webm" }; |
| 93 | + public static final String[] VIDEO_FILE_SUFFIXS = new String[] { ".flv", ".swf", ".mkv", ".avi", ".rm", ".rmvb", ".mpeg", |
| 94 | + ".mpg", ".ogg", ".ogv", ".mov", ".wmv", ".mp4", ".webm" }; |
91 | 95 | /** |
92 | 96 | * |
93 | 97 | */ |
94 | | - public static final String[] OTHER_FILE_SUFFIXS = new String[] { ".rar", ".zip", ".tar", ".gz", ".7z", ".bz2", ".cab", ".iso", ".psd" }; |
| 98 | + public static final String[] OTHER_FILE_SUFFIXS = new String[] { ".rar", ".zip", ".tar", ".gz", ".7z", ".bz2", ".cab", ".iso", |
| 99 | + ".psd" }; |
95 | 100 | /** |
96 | 101 | * |
97 | 102 | */ |
98 | | - public static final String[] ALLOW_FILES = ArrayUtils |
99 | | - .addAll(ArrayUtils.addAll(ArrayUtils.addAll(ArrayUtils.addAll(AUDIO_FILE_SUFFIXS, VIDEO_FILE_SUFFIXS), IMAGE_FILE_SUFFIXS), DOCUMENT_FILE_SUFFIXS), OTHER_FILE_SUFFIXS); |
| 103 | + public static final String[] ALLOW_FILES = ArrayUtils.addAll( |
| 104 | + ArrayUtils.addAll(ArrayUtils.addAll(ArrayUtils.addAll(AUDIO_FILE_SUFFIXS, VIDEO_FILE_SUFFIXS), IMAGE_FILE_SUFFIXS), |
| 105 | + DOCUMENT_FILE_SUFFIXS), |
| 106 | + OTHER_FILE_SUFFIXS); |
100 | 107 | /** |
101 | 108 | * |
102 | 109 | */ |
103 | 110 | public static final String[] IMAGE_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_IMAGE }; |
104 | 111 | /** |
105 | 112 | * |
106 | 113 | */ |
107 | | - public static final String[] OTHER_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_VIDEO, CmsFileUtils.FILE_TYPE_AUDIO, CmsFileUtils.FILE_TYPE_DOCUMENT, CmsFileUtils.FILE_TYPE_OTHER }; |
| 114 | + public static final String[] OTHER_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_VIDEO, CmsFileUtils.FILE_TYPE_AUDIO, |
| 115 | + CmsFileUtils.FILE_TYPE_DOCUMENT, CmsFileUtils.FILE_TYPE_OTHER }; |
108 | 116 |
|
109 | 117 | /** |
110 | 118 | * |
@@ -256,7 +264,8 @@ public static List<FileInfo> getFileList(String dirPath, boolean useFilter, Stri |
256 | 264 | Path fileNamePath = entry.getFileName(); |
257 | 265 | if (null != fileNamePath) { |
258 | 266 | String fileName = fileNamePath.toString(); |
259 | | - if (!useFilter || !fileName.endsWith(".data") && !TemplateComponent.INCLUDE_DIRECTORY.equalsIgnoreCase(fileName)) { |
| 267 | + if (!useFilter |
| 268 | + || !fileName.endsWith(".data") && !TemplateComponent.INCLUDE_DIRECTORY.equalsIgnoreCase(fileName)) { |
260 | 269 | BasicFileAttributes attrs = Files.readAttributes(entry, BasicFileAttributes.class); |
261 | 270 | fileList.add(new FileInfo(fileName, attrs.isDirectory(), attrs)); |
262 | 271 | } |
@@ -560,20 +569,46 @@ public static boolean isSafe(String filepath, String suffix) { |
560 | 569 |
|
561 | 570 | private static boolean isSafe(List<COSObject> pdfObjects) { |
562 | 571 | for (COSObject object : pdfObjects) { |
563 | | - COSBase realObject = object.getObject(); |
564 | | - if (realObject instanceof COSDictionary) { |
565 | | - COSDictionary dic = (COSDictionary) realObject; |
566 | | - if (null != dic.getDictionaryObject(COSName.JS) || null != dic.getDictionaryObject(COSName.JAVA_SCRIPT)) { |
567 | | - return false; |
568 | | - } |
569 | | - } else if (realObject instanceof COSName && (COSName.JS.equals(realObject) || COSName.JAVA_SCRIPT.equals(realObject))) { |
| 572 | + if (isUnSafe(object)) { |
570 | 573 | return false; |
571 | | - |
572 | 574 | } |
573 | 575 | } |
574 | 576 | return true; |
575 | 577 | } |
576 | 578 |
|
| 579 | + private static boolean isUnSafe(Collection<COSBase> pdfObjects) { |
| 580 | + for (COSBase object : pdfObjects) { |
| 581 | + if (isUnSafe(object)) { |
| 582 | + return true; |
| 583 | + } |
| 584 | + } |
| 585 | + return false; |
| 586 | + } |
| 587 | + |
| 588 | + private static boolean isUnSafe(COSObject object) { |
| 589 | + return isUnSafe(object.getObject()); |
| 590 | + } |
| 591 | + |
| 592 | + private static boolean isUnSafe(COSBase realObject) { |
| 593 | + if (realObject instanceof COSDictionary) { |
| 594 | + COSDictionary dic = (COSDictionary) realObject; |
| 595 | + if (null != dic.getDictionaryObject(COSName.JS) || null != dic.getDictionaryObject(COSName.JAVA_SCRIPT)) { |
| 596 | + return true; |
| 597 | + } |
| 598 | + return isUnSafe(dic.getValues()); |
| 599 | + } else if (realObject instanceof COSArray) { |
| 600 | + COSArray array = (COSArray) realObject; |
| 601 | + for (COSBase object : array) { |
| 602 | + if (isUnSafe(object)) { |
| 603 | + return true; |
| 604 | + } |
| 605 | + } |
| 606 | + } else if (realObject instanceof COSName && (COSName.JS.equals(realObject) || COSName.JAVA_SCRIPT.equals(realObject))) { |
| 607 | + return false; |
| 608 | + } |
| 609 | + return false; |
| 610 | + } |
| 611 | + |
577 | 612 | /** |
578 | 613 | * 获取文件内容 Get file content ファイルの内容を取得します |
579 | 614 | * |
@@ -658,7 +693,8 @@ public static String getSuffix(String originalFilename) { |
658 | 693 | if (null != originalFilename) { |
659 | 694 | int index = originalFilename.lastIndexOf(Constants.DOT); |
660 | 695 | if (-1 < index) { |
661 | | - return originalFilename.substring(originalFilename.lastIndexOf(Constants.DOT), originalFilename.length()).toLowerCase(); |
| 696 | + return originalFilename.substring(originalFilename.lastIndexOf(Constants.DOT), originalFilename.length()) |
| 697 | + .toLowerCase(); |
662 | 698 | } |
663 | 699 | } |
664 | 700 | return null; |
@@ -711,7 +747,8 @@ public static String upload(byte[] data, String fileName) throws IllegalStateExc |
711 | 747 | * @throws IllegalStateException |
712 | 748 | * @throws IOException |
713 | 749 | */ |
714 | | - public static String upload(byte[] data, String fileName, String originalName, String metadataPath) throws IllegalStateException, IOException { |
| 750 | + public static String upload(byte[] data, String fileName, String originalName, String metadataPath) |
| 751 | + throws IllegalStateException, IOException { |
715 | 752 | File dest = new File(fileName); |
716 | 753 | dest.getParentFile().mkdirs(); |
717 | 754 | FileUtils.writeByteArrayToFile(dest, data); |
|
0 commit comments