Skip to content

Commit 423dd79

Browse files
sanluansanluan
committed
https://github.com/sanluan/PublicCMS/issues/103
1 parent 1f52730 commit 423dd79

File tree

3 files changed

+56
-17
lines changed

3 files changed

+56
-17
lines changed

‎publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/tools/CmsFileUtils.java‎

Lines changed: 54 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import java.nio.file.attribute.BasicFileAttributes;
1616
import java.util.ArrayList;
1717
import java.util.Arrays;
18+
import java.util.Collection;
1819
import java.util.Collections;
1920
import java.util.Comparator;
2021
import java.util.Date;
@@ -25,6 +26,7 @@
2526
import org.apache.commons.io.FileUtils;
2627
import org.apache.commons.io.IOUtils;
2728
import org.apache.commons.lang3.ArrayUtils;
29+
import org.apache.pdfbox.cos.COSArray;
2830
import org.apache.pdfbox.cos.COSBase;
2931
import org.apache.pdfbox.cos.COSDictionary;
3032
import org.apache.pdfbox.cos.COSName;
@@ -83,28 +85,34 @@ private CmsFileUtils() {
8385
/**
8486
*
8587
*/
86-
public static final String[] DOCUMENT_FILE_SUFFIXS = new String[] { ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".pdf", ".txt", ".md", ".ofd" };
88+
public static final String[] DOCUMENT_FILE_SUFFIXS = new String[] { ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".pdf",
89+
".txt", ".md", ".ofd" };
8790
/**
8891
*
8992
*/
90-
public static final String[] VIDEO_FILE_SUFFIXS = new String[] { ".flv", ".swf", ".mkv", ".avi", ".rm", ".rmvb", ".mpeg", ".mpg", ".ogg", ".ogv", ".mov", ".wmv", ".mp4", ".webm" };
93+
public static final String[] VIDEO_FILE_SUFFIXS = new String[] { ".flv", ".swf", ".mkv", ".avi", ".rm", ".rmvb", ".mpeg",
94+
".mpg", ".ogg", ".ogv", ".mov", ".wmv", ".mp4", ".webm" };
9195
/**
9296
*
9397
*/
94-
public static final String[] OTHER_FILE_SUFFIXS = new String[] { ".rar", ".zip", ".tar", ".gz", ".7z", ".bz2", ".cab", ".iso", ".psd" };
98+
public static final String[] OTHER_FILE_SUFFIXS = new String[] { ".rar", ".zip", ".tar", ".gz", ".7z", ".bz2", ".cab", ".iso",
99+
".psd" };
95100
/**
96101
*
97102
*/
98-
public static final String[] ALLOW_FILES = ArrayUtils
99-
.addAll(ArrayUtils.addAll(ArrayUtils.addAll(ArrayUtils.addAll(AUDIO_FILE_SUFFIXS, VIDEO_FILE_SUFFIXS), IMAGE_FILE_SUFFIXS), DOCUMENT_FILE_SUFFIXS), OTHER_FILE_SUFFIXS);
103+
public static final String[] ALLOW_FILES = ArrayUtils.addAll(
104+
ArrayUtils.addAll(ArrayUtils.addAll(ArrayUtils.addAll(AUDIO_FILE_SUFFIXS, VIDEO_FILE_SUFFIXS), IMAGE_FILE_SUFFIXS),
105+
DOCUMENT_FILE_SUFFIXS),
106+
OTHER_FILE_SUFFIXS);
100107
/**
101108
*
102109
*/
103110
public static final String[] IMAGE_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_IMAGE };
104111
/**
105112
*
106113
*/
107-
public static final String[] OTHER_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_VIDEO, CmsFileUtils.FILE_TYPE_AUDIO, CmsFileUtils.FILE_TYPE_DOCUMENT, CmsFileUtils.FILE_TYPE_OTHER };
114+
public static final String[] OTHER_FILETYPES = new String[] { CmsFileUtils.FILE_TYPE_VIDEO, CmsFileUtils.FILE_TYPE_AUDIO,
115+
CmsFileUtils.FILE_TYPE_DOCUMENT, CmsFileUtils.FILE_TYPE_OTHER };
108116

109117
/**
110118
*
@@ -256,7 +264,8 @@ public static List<FileInfo> getFileList(String dirPath, boolean useFilter, Stri
256264
Path fileNamePath = entry.getFileName();
257265
if (null != fileNamePath) {
258266
String fileName = fileNamePath.toString();
259-
if (!useFilter || !fileName.endsWith(".data") && !TemplateComponent.INCLUDE_DIRECTORY.equalsIgnoreCase(fileName)) {
267+
if (!useFilter
268+
|| !fileName.endsWith(".data") && !TemplateComponent.INCLUDE_DIRECTORY.equalsIgnoreCase(fileName)) {
260269
BasicFileAttributes attrs = Files.readAttributes(entry, BasicFileAttributes.class);
261270
fileList.add(new FileInfo(fileName, attrs.isDirectory(), attrs));
262271
}
@@ -560,20 +569,46 @@ public static boolean isSafe(String filepath, String suffix) {
560569

561570
private static boolean isSafe(List<COSObject> pdfObjects) {
562571
for (COSObject object : pdfObjects) {
563-
COSBase realObject = object.getObject();
564-
if (realObject instanceof COSDictionary) {
565-
COSDictionary dic = (COSDictionary) realObject;
566-
if (null != dic.getDictionaryObject(COSName.JS) || null != dic.getDictionaryObject(COSName.JAVA_SCRIPT)) {
567-
return false;
568-
}
569-
} else if (realObject instanceof COSName && (COSName.JS.equals(realObject) || COSName.JAVA_SCRIPT.equals(realObject))) {
572+
if (isUnSafe(object)) {
570573
return false;
571-
572574
}
573575
}
574576
return true;
575577
}
576578

579+
private static boolean isUnSafe(Collection<COSBase> pdfObjects) {
580+
for (COSBase object : pdfObjects) {
581+
if (isUnSafe(object)) {
582+
return true;
583+
}
584+
}
585+
return false;
586+
}
587+
588+
private static boolean isUnSafe(COSObject object) {
589+
return isUnSafe(object.getObject());
590+
}
591+
592+
private static boolean isUnSafe(COSBase realObject) {
593+
if (realObject instanceof COSDictionary) {
594+
COSDictionary dic = (COSDictionary) realObject;
595+
if (null != dic.getDictionaryObject(COSName.JS) || null != dic.getDictionaryObject(COSName.JAVA_SCRIPT)) {
596+
return true;
597+
}
598+
return isUnSafe(dic.getValues());
599+
} else if (realObject instanceof COSArray) {
600+
COSArray array = (COSArray) realObject;
601+
for (COSBase object : array) {
602+
if (isUnSafe(object)) {
603+
return true;
604+
}
605+
}
606+
} else if (realObject instanceof COSName && (COSName.JS.equals(realObject) || COSName.JAVA_SCRIPT.equals(realObject))) {
607+
return false;
608+
}
609+
return false;
610+
}
611+
577612
/**
578613
* 获取文件内容 Get file content ファイルの内容を取得します
579614
*
@@ -658,7 +693,8 @@ public static String getSuffix(String originalFilename) {
658693
if (null != originalFilename) {
659694
int index = originalFilename.lastIndexOf(Constants.DOT);
660695
if (-1 < index) {
661-
return originalFilename.substring(originalFilename.lastIndexOf(Constants.DOT), originalFilename.length()).toLowerCase();
696+
return originalFilename.substring(originalFilename.lastIndexOf(Constants.DOT), originalFilename.length())
697+
.toLowerCase();
662698
}
663699
}
664700
return null;
@@ -711,7 +747,8 @@ public static String upload(byte[] data, String fileName) throws IllegalStateExc
711747
* @throws IllegalStateException
712748
* @throws IOException
713749
*/
714-
public static String upload(byte[] data, String fileName, String originalName, String metadataPath) throws IllegalStateException, IOException {
750+
public static String upload(byte[] data, String fileName, String originalName, String metadataPath)
751+
throws IllegalStateException, IOException {
715752
File dest = new File(fileName);
716753
dest.getParentFile().mkdirs();
717754
FileUtils.writeByteArrayToFile(dest, data);

‎publiccms-parent/publiccms/src/test/java/com/publiccms/test/tools/PdfXssTest.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
class PdfXssTest {
1717
protected final Log log = LogFactory.getLog(getClass());
1818
String filepath = "src/test/resources/test/tools/xss.pdf";
19+
String filepath2 = "src/test/resources/test/tools/xss2.pdf";
1920
String safePdfpath = "src/test/resources/test/tools/safe.pdf";
2021

2122
@Test
@@ -46,6 +47,7 @@ void isDirectory() {
4647
@DisplayName("pdf xss test case")
4748
void pdfxss() {
4849
Assertions.assertFalse(CmsFileUtils.isSafe(filepath, CmsFileUtils.getSuffix(filepath)));
50+
Assertions.assertFalse(CmsFileUtils.isSafe(filepath2, CmsFileUtils.getSuffix(filepath2)));
4951
Assertions.assertTrue(CmsFileUtils.isSafe(safePdfpath, CmsFileUtils.getSuffix(safePdfpath)));
5052
}
5153

‎publiccms-parent/publiccms/src/test/resources/test/tools/xss2.pdf‎

660 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)