fix: harden every shipped config and isolate archive storage tests

.github/workflows/maven.yml

@@ -39,7 +39,7 @@ jobs:
       if: runner.os == 'Linux'
       run: >-
         mvn -B -pl server
-        -Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
+        -Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ActuatorOverrideExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
         test
 
     - name: Validate Windows deployment

server/src/main/config/test.properties

@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl
 
 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health,info,metrics
+management.endpoints.web.exposure.include = health
-management.endpoint.health.show-details = always
+management.endpoint.health.show-details = never
 management.health.defaults.enabled = true
 
 

server/src/main/java/cn/keking/service/CompressFileReader.java

@@ -35,13 +35,13 @@ import java.util.List;
 @Component
 public class CompressFileReader {
     private final FileHandlerService fileHandlerService;
-    private static final String fileDir = ConfigConstants.getFileDir();
 
     public CompressFileReader(FileHandlerService fileHandlerService) {
         this.fileHandlerService = fileHandlerService;
     }
 
     public String unRar(String filePath, String filePassword, String fileName, FileAttribute fileAttribute) throws Exception {
+        String fileDir = ConfigConstants.getFileDir();
         List<String> imgUrls = new ArrayList<>();
         String baseUrl = BaseUrlFilter.getBaseUrl();
         String packagePath = "_";

server/src/test/java/cn/keking/config/ActuatorOverrideExposureSecurityTests.java

@@ -0,0 +1,9 @@
+package cn.keking.config;
+
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class,
+        properties = "spring.config.name=test",
+        webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class ActuatorOverrideExposureSecurityTests extends ActuatorExposureSecurityTests {
+}

server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java

@@ -7,6 +7,7 @@ import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.List;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
@@ -17,18 +18,23 @@ class ArchiveTraversalSecurityTests {
 
     @Test void existingExtractorRejectsZipSlipBeforeWritingOutsideArchive() throws Exception {
         String previous = ConfigConstants.getFileDir();
-        ConfigConstants.setFileDirValue(temp.toString());
         try {
-            Path archive = temp.resolve("malicious.zip");
+            CompressFileReader reader = new CompressFileReader(null);
-            try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
+            for (String directory : List.of("first", "second")) {
-                zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
+                Path root = Files.createDirectory(temp.resolve(directory));
-                zip.write("BENIGN-CANARY".getBytes());
+                ConfigConstants.setFileDirValue(root.toString());
-                zip.closeEntry();
+                Path archive = root.resolve("malicious.zip");
+                try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
+                    zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
+                    zip.write("BENIGN-CANARY".getBytes());
+                    zip.closeEntry();
+                }
+                Exception error = assertThrows(Exception.class, () -> reader
+                        .unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
+                assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
+                assertTrue(Files.isDirectory(root.resolve("malicious.zip_")));
+                assertFalse(Files.exists(root.resolve("outside-marker.txt")));
             }
-            Exception error = assertThrows(Exception.class, () -> new CompressFileReader(null)
-                    .unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
-            assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
-            assertFalse(Files.exists(temp.resolve("outside-marker.txt")));
         } finally {
             ConfigConstants.setFileDirValue(previous);
         }