xiazai bug

eitc-admin/src/main/java/com/eitc/web/controller/common/DownloadController.java

@@ -24,54 +24,42 @@ import javax.servlet.http.HttpServletResponse;
 @RestController
 @RequestMapping("/download")
 public class DownloadController extends BaseController {
-    private static final Logger log = LoggerFactory.getLogger(DownloadController.class);
 
     /**
      * 硬件app
      */
     @GetMapping("/hardware")
-    public void hardware(HttpServletRequest request, HttpServletResponse response) {
-        try {
-            String resource = "/profile/app/huishitong.apk";
-            resourceDownload(resource, request, response);
-        } catch (Exception e) {
-            log.error("下载文件失败", e);
-        }
+    public void hardware(HttpServletRequest request, HttpServletResponse response) throws Exception {
+        String resource = "/profile/app/huishitong.apk";
+        resourceDownload(resource, response);
     }
 
     @GetMapping("/hospital")
-    public void hospital(HttpServletRequest request, HttpServletResponse response) {
-        try {
-            String resource = "/profile/app/kouqiangyiyuan_1.0.0_1_240830_release.apk";
-            resourceDownload(resource, request, response);
-        } catch (Exception e) {
-            log.error("下载文件失败", e);
-        }
+    public void hospital(HttpServletResponse response) throws Exception {
+        String resource = "/profile/app/kouqiangyiyuan_1.0.0_1_240830_release.apk";
+        resourceDownload(resource, response);
     }
 
     @GetMapping("/document")
-    public void document(HttpServletRequest request, HttpServletResponse response) {
-        try {
-            String resource = "/profile/app/document.pdf";
-            resourceDownload(resource, request, response);
-        } catch (Exception e) {
-            log.error("下载文件失败", e);
-        }
+    public void document(HttpServletResponse response) throws Exception {
+        String resource = "/profile/app/document.pdf";
+        resourceDownload(resource, response);
     }
 
-    public void resourceDownload(String resource, HttpServletRequest request, HttpServletResponse response) throws Exception {
-            if (!FileUtils.checkAllowDownload(resource)) {
-                throw new Exception(StringUtils.format("资源文件({})非法，不允许下载。 ", resource));
-            }
-            // 本地资源路径
-            String localPath = EitcConfig.getProfile();
-            // 数据库资源地址
-            String downloadPath = localPath + StringUtils.substringAfter(resource, Constants.RESOURCE_PREFIX);
-            // 下载名称
-            String downloadName = StringUtils.substringAfterLast(downloadPath, "/");
-            response.setContentType(MediaType.APPLICATION_OCTET_STREAM_VALUE);
-            FileUtils.setAttachmentResponseHeader(response, downloadName);
-            FileUtils.writeBytes(downloadPath, response.getOutputStream());
+    public void resourceDownload(String resource, HttpServletResponse response) throws Exception {
+        // 禁止目录上跳级别
+        if (StringUtils.contains(resource, "..")) {
+            throw new Exception(StringUtils.format("资源文件({})非法，不允许下载。 ", resource));
+        }
+        // 本地资源路径
+        String localPath = EitcConfig.getProfile();
+        // 数据库资源地址
+        String downloadPath = localPath + StringUtils.substringAfter(resource, Constants.RESOURCE_PREFIX);
+        // 下载名称
+        String downloadName = StringUtils.substringAfterLast(downloadPath, "/");
+        response.setContentType(MediaType.APPLICATION_OCTET_STREAM_VALUE);
+        FileUtils.setAttachmentResponseHeader(response, downloadName);
+        FileUtils.writeBytes(downloadPath, response.getOutputStream());
     }
 
 }