From 28600ea7f9796b55a8242789945f075ac9b84ef1 Mon Sep 17 00:00:00 2001 From: imhao183 Date: Mon, 8 Jun 2020 21:42:25 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=96=87=E4=BB=B6=E5=90=8D?= =?UTF-8?q?=E4=B8=AD=E5=B8=A6=E6=9C=89&=E5=AD=97=E7=AC=A6=E9=94=99?= =?UTF-8?q?=E8=AF=AF=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../main/java/com/xiaoleilu/loServer/action/FileAction.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/broker/src/main/java/com/xiaoleilu/loServer/action/FileAction.java b/broker/src/main/java/com/xiaoleilu/loServer/action/FileAction.java index 8cc64f10..25ca9397 100755 --- a/broker/src/main/java/com/xiaoleilu/loServer/action/FileAction.java +++ b/broker/src/main/java/com/xiaoleilu/loServer/action/FileAction.java @@ -109,7 +109,8 @@ public class FileAction extends Action { } // 路径安全检查 - if (httpPath.contains("/.") || httpPath.contains("./") || httpPath.charAt(0) == '.' || httpPath.charAt(httpPath.length() - 1) == '.' || ReUtil.isMatch(INSECURE_URI, httpPath)) { + String path = httpPath.substring(0, httpPath.lastIndexOf("/")); + if (path.contains("/.") || path.contains("./") || path.charAt(0) == '.' || path.charAt(path.length() - 1) == '.' || ReUtil.isMatch(INSECURE_URI, path)) { return null; }