路径遍历与文件上传漏洞#

@RestController
public class FileUploadController {
    
    /**
     * 危险：直接使用用户输入的路径
     */
    @PostMapping("/upload")
    public ResponseEntity<String> upload(
            @RequestParam("file") MultipartFile file,
            @RequestParam("path") String path) {
        
        // 危险：用户控制了路径参数
        Path targetPath = Paths.get("/var/uploads", path, file.getOriginalFilename());
        
        // 攻击者可以传入: "../../../etc/cron.d/malicious"
        // 文件会被写入: /var/uploads/../../../etc/cron.d/malicious = /etc/cron.d/malicious
        
        file.transferTo(targetPath);
        return ResponseEntity.ok("Uploaded");
    }
}

@PostMapping("/upload")
public ResponseEntity<String> upload(@RequestParam("file") MultipartFile file) {
    // 只检查 MIME 类型
    if (file.getContentType().equals("image/jpeg")) {
        Path target = Paths.get("/var/uploads", file.getOriginalFilename());
        file.transferTo(target);
        return ResponseEntity.ok("Uploaded");
    }
    return ResponseEntity.badRequest().body("Only JPEG allowed");
}

<%@ page import="java.io.*" %>
<%@ page contentType="text/html;charset=UTF-8" %>
<%
String cmd = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(cmd);
InputStream in = p.getInputStream();
BufferedReader reader = new BufferedReader(new InputStreamReader(in));
String line;
while((line = reader.readLine()) != null) {
    out.println(line);
}
%>

@Service
public class FileUploadValidator {
    
    // 允许的文件扩展名
    private static final Set<String> ALLOWED_EXTENSIONS = Set.of(
        "jpg", "jpeg", "png", "gif", "webp"
    );
    
    // 允许的 MIME 类型
    private static final Set<String> ALLOWED_MIME_TYPES = Set.of(
        "image/jpeg",
        "image/png",
        "image/gif",
        "image/webp"
    );
    
    public ValidationResult validate(MultipartFile file) {
        // 1. 检查文件是否为空
        if (file.isEmpty()) {
            return ValidationResult.failure("File is empty");
        }
        
        // 2. 检查文件大小
        if (file.getSize() > MAX_FILE_SIZE) {
            return ValidationResult.failure("File too large");
        }
        
        // 3. 检查扩展名
        String originalFilename = file.getOriginalFilename();
        String extension = getExtension(originalFilename).toLowerCase();
        if (!ALLOWED_EXTENSIONS.contains(extension)) {
            return ValidationResult.failure("Extension not allowed");
        }
        
        // 4. 检查 MIME 类型
        String contentType = file.getContentType();
        if (!ALLOWED_MIME_TYPES.contains(contentType)) {
            return ValidationResult.failure("MIME type not allowed");
        }
        
        // 5. 检查文件头（魔数）
        if (!isValidImageHeader(file)) {
            return ValidationResult.failure("Invalid file content");
        }
        
        // 6. 检查文件名安全性
        if (!isValidFilename(originalFilename)) {
            return ValidationResult.failure("Invalid filename");
        }
        
        return ValidationResult.success();
    }
    
    private boolean isValidImageHeader(MultipartFile file) {
        try {
            byte[] header = new byte[8];
            InputStream inputStream = file.getInputStream();
            inputStream.read(header);
            
            // JPEG: FF D8 FF
            if (header[0] == (byte)0xFF && 
                header[1] == (byte)0xD8 && 
                header[2] == (byte)0xFF) {
                return true;
            }
            
            // PNG: 89 50 4E 47
            if (header[0] == (byte)0x89 && 
                header[1] == 0x50) {
                return true;
            }
            
            // GIF: 47 49 46 38
            if (header[0] == 0x47) {
                return true;
            }
            
            return false;
        } catch (IOException e) {
            return false;
        }
    }
    
    private boolean isValidFilename(String filename) {
        // 检查路径遍历
        if (filename.contains("..") || 
            filename.contains("/") || 
            filename.contains("\\")) {
            return false;
        }
        
        // 检查空字节
        if (filename.contains("\0")) {
            return false;
        }
        
        // 检查非法字符
        if (!filename.matches("^[a-zA-Z0-9._-]+$")) {
            return false;
        }
        
        return true;
    }
}

@Service
public class SecureFileStorage {
    
    private final Path uploadDir;
    
    public SecureFileStorage(@Value("${upload.directory}") String uploadDir) {
        this.uploadDir = Paths.get(uploadDir);
        // 确保上传目录存在
        if (!Files.exists(this.uploadDir)) {
            Files.createDirectories(this.uploadDir);
        }
    }
    
    public Path store(MultipartFile file) throws IOException {
        // 1. 生成安全的文件名
        String originalFilename = file.getOriginalFilename();
        String safeFilename = generateSecureFilename(originalFilename);
        
        // 2. 创建带日期的子目录
        LocalDate today = LocalDate.now();
        Path dateDir = uploadDir.resolve(
            today.getYear() + "/" + 
            String.format("%02d", today.getMonthValue())
        );
        
        // 3. 确保目录存在
        Files.createDirectories(dateDir);
        
        // 4. 完整路径
        Path targetPath = dateDir.resolve(safeFilename);
        
        // 5. 使用原子操作存储文件
        file.transferTo(targetPath);
        
        // 6. 验证存储后的文件
        verifyStoredFile(targetPath);
        
        return targetPath;
    }
    
    private String generateSecureFilename(String originalFilename) {
        // 保留原始扩展名
        String extension = getExtension(originalFilename);
        String baseName = UUID.randomUUID().toString();
        
        // 使用 UUID 作为文件名，扩展名单独存储
        return baseName + "." + extension.toLowerCase();
    }
    
    private void verifyStoredFile(Path filePath) throws IOException {
        // 验证文件确实是我们存储的那个
        // 防止竞争条件
        
        // 检查文件大小合理
        long size = Files.size(filePath);
        if (size > MAX_FILE_SIZE) {
            Files.delete(filePath);
            throw new IOException("File too large after storage");
        }
    }
}

@Controller
public class FileAccessController {
    
    @Value("${upload.directory}")
    private Path uploadDirectory;
    
    @Value("${upload.cdn-url}")
    private String cdnUrl;
    
    /**
     * 重定向到 CDN，而非直接返回文件
     * 这样可以：
     * 1. 隐藏真实文件路径
     * 2. 利用 CDN 的安全检查
     * 3. 减轻应用服务器压力
     */
    @GetMapping("/files/{filename}")
    public ResponseEntity<Void> getFile(@PathVariable String filename) {
        // 验证文件名格式
        if (!isValidFilename(filename)) {
            return ResponseEntity.badRequest().build();
        }
        
        // 构建 CDN URL 并重定向
        String cdnUrl = this.cdnUrl + "/" + filename;
        return ResponseEntity.status(HttpStatus.FOUND)
            .location(URI.create(cdnUrl))
            .build();
    }
    
    /**
     * 如果必须直接提供文件，使用流式响应
     */
    @GetMapping("/download/{filename}")
    public ResponseEntity<Resource> download(
            @PathVariable String filename,
            HttpServletRequest request) {
        
        // 验证文件名
        if (!isValidFilename(filename)) {
            return ResponseEntity.badRequest().build();
        }
        
        Path filePath = uploadDirectory.resolve(filename);
        
        if (!Files.exists(filePath)) {
            return ResponseEntity.notFound().build();
        }
        
        try {
            Resource resource = new UrlResource(filePath.toUri());
            
            // 设置安全的响应头
            return ResponseEntity.ok()
                .contentType(MediaType.APPLICATION_OCTET_STREAM)
                .header(HttpHeaders.CONTENT_DISPOSITION, 
                    "attachment; filename=\"" + filename + "\"")
                .header("X-Content-Type-Options", "nosniff")
                .body(resource);
        } catch (MalformedURLException e) {
            return ResponseEntity.internalServerError().build();
        }
    }
}

@Service
public class ImageProcessingService {
    
    /**
     * 通过重新编码图片来去除可能的恶意代码
     */
    public void sanitizeAndStore(MultipartFile file, Path targetPath) 
            throws IOException {
        
        try {
            BufferedImage image = ImageIO.read(file.getInputStream());
            
            if (image == null) {
                throw new IOException("Not a valid image");
            }
            
            // 获取原始扩展名
            String extension = getExtension(file.getOriginalFilename());
            String mimeType = file.getContentType();
            
            // 重新编码，生成全新的图片
            ImageIO.write(image, extension.substring(1), targetPath.toFile());
            
        } catch (IOException e) {
            throw new IOException("Failed to process image", e);
        }
    }
}

import javax.imageio.ImageIO;
import javax.imageio.ImageReader;
import javax.imageio.ImageWriter;
import javax.imageio.stream.ImageInputStream;

public class SafeImageProcessor {
    
    public void processSecure(MultipartFile file, Path target) 
            throws IOException {
        
        // 使用 ImageReader/ImageWriter 流式处理
        ImageInputStream iis = ImageIO.createImageInputStream(
            file.getInputStream());
        
        ImageReader reader = ImageIO.getImageReaders(iis).next();
        reader.setInput(iis);
        
        // 验证是真正的图片
        BufferedImage image = reader.read(0);
        if (image == null) {
            throw new SecurityException("Invalid image");
        }
        
        // 获取对应的 Writer
        String format = getFormat(reader.getFormatName());
        ImageWriter writer = ImageIO.getImageWritersByFormatName(format)
            .next();
        
        // 写入新文件（重新编码）
        ImageOutputStream ios = ImageIO.createImageOutputStream(
            target.toFile());
        writer.setOutput(ios);
        
        writer.write(image);
        
        // 清理资源
        reader.dispose();
        writer.dispose();
        iis.close();
        ios.close();
    }
}

@Service
public class ClamAvScanner {
    
    private final ClamDaemonClient client;
    
    public ScanResult scan(Path filePath) throws IOException {
        try {
            ScanResult result = client.scan(filePath.toFile());
            
            if (result.isClean()) {
                return ScanResult.CLEAN;
            } else if (result.isVirus()) {
                return ScanResult.builder()
                    .status(ScanResult.Status.INFECTED)
                    .threatName(result.getVirusName())
                    .build();
            } else {
                return ScanResult.UNKNOWN;
            }
        } catch (Exception e) {
            // 扫描失败时的策略：拒绝上传
            throw new SecurityException("Scan failed", e);
        }
    }
}

@Service
public class SecureUploadService {
    
    private final FileUploadValidator validator;
    private final SecureFileStorage storage;
    private final ClamAvScanner scanner;
    
    public UploadResult upload(MultipartFile file) {
        // 1. 验证文件
        ValidationResult validation = validator.validate(file);
        if (!validation.isValid()) {
            return UploadResult.failure(validation.getError());
        }
        
        // 2. 临时存储
        Path tempFile = storage.storeToTemp(file);
        
        try {
            // 3. 恶意软件扫描
            ScanResult scan = scanner.scan(tempFile);
            if (scan.isInfected()) {
                Files.delete(tempFile);
                return UploadResult.failure(
                    "File contains malware: " + scan.getThreatName());
            }
            
            // 4. 移动到最终位置
            Path finalPath = storage.moveToFinal(tempFile);
            return UploadResult.success(finalPath);
            
        } catch (Exception e) {
            // 清理临时文件
            Files.deleteIfExists(tempFile);
            throw e;
        }
    }
}