From 2f9c4e028c01c64913cab32e7248bcca183a5230 Mon Sep 17 00:00:00 2001
From: heavyrian2012 <heavyrain.lee@wildfirehat.cn>
Date: Tue, 2 Dec 2025 14:46:00 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A7=A3=E5=86=B3=E4=B8=8A=E4=BC=A0=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E4=B8=AD=E7=9A=84=E9=80=BB=E8=BE=91=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../xiaoleilu/loServer/action/UploadFileAction.java | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java b/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java
index 58bad312..f144fc00 100755
--- a/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java
+++ b/broker/src/main/java/com/xiaoleilu/loServer/action/UploadFileAction.java
@@ -24,6 +24,8 @@ import org.slf4j.LoggerFactory;
 
 import java.io.File;
 import java.io.RandomAccessFile;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.text.SimpleDateFormat;
 import java.util.Date;
 import java.util.UUID;
@@ -213,7 +215,7 @@ public class UploadFileAction extends Action {
                     return false;
                 }
 
-
+                remoteFileName = getSafeFileName(remoteFileName);
 
                 String remoteFileExt = "";
                 if (remoteFileName.lastIndexOf(".") == -1) {
@@ -339,6 +341,15 @@ public class UploadFileAction extends Action {
         return true;
     }
 
+    private static String getSafeFileName(String originalFilename) {
+        // Paths.get() 会解析路径，getFileName() 只取最后一部分（纯文件名）
+        Path filenamePath = Paths.get(originalFilename.trim());
+        String safeFilename = filenamePath.getFileName().toString();
+        // 额外过滤特殊字符（可选，根据业务需要）
+        safeFilename = safeFilename.replaceAll("[\\\\/:*?\"<>|]", "_");
+        return safeFilename.isEmpty() ? "default_file_" + System.currentTimeMillis() : safeFilename;
+    }
+
     public static void put(File file, long pos, byte[] data) throws Exception {
         RandomAccessFile raf = null;
         try {