lsm/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2025-10-24 09:49:08 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

移除 Apache-common-text 包，采用 spring 内置的 HtmlUtils 处理 xss 问题

Browse Source
This commit is contained in:
chenkailing
2021-01-23 13:12:31 +08:00
committed by kl
parent 2dd067170b
commit 996da0862c
2 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/pom.xml
View File

@@ -62,11 +62,6 @@
<artifactId>commons-lang3</artifactId> <artifactId>commons-lang3</artifactId>
<version>3.7</version> <version>3.7</version>
</dependency> </dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>1.9</version>
</dependency>
<!-- REDISSON --> <!-- REDISSON -->
<dependency> <dependency>
<groupId>org.redisson</groupId> <groupId>org.redisson</groupId>

6
server/src/main/java/cn/keking/web/controller/FileController.java
View File

@@ -15,8 +15,9 @@ import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile; import org.springframework.web.multipart.MultipartFile;
import java.io.*; import java.io.*;
import java.nio.charset.StandardCharsets;
import java.util.*; import java.util.*;
import org.apache.commons.text.StringEscapeUtils; import org.springframework.web.util.HtmlUtils;
/** /**
* *
@@ -39,7 +40,8 @@ public class FileController {
//判断是否为IE浏览器的文件名，IE浏览器下文件名会带有盘符信息 //判断是否为IE浏览器的文件名，IE浏览器下文件名会带有盘符信息
// escaping dangerous characters to prevent XSS // escaping dangerous characters to prevent XSS
fileName = StringEscapeUtils.escapeHtml4(fileName); fileName = HtmlUtils.htmlEscape(fileName, StandardCharsets.UTF_8.name());
// Check for Unix-style path // Check for Unix-style path
int unixSep = fileName.lastIndexOf('/'); int unixSep = fileName.lastIndexOf('/');
// Check for Windows-style path // Check for Windows-style path