open-source/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2026-11-11 13:50:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden every shipped config and isolate archive storage tests

Browse Source
This commit is contained in:
kl
2026-10-08 15:46:27 +08:00
parent 7d311ee02f
commit 3c73d8e0e1
5 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/maven.yml vendored
View File

@@ -39,7 +39,7 @@ jobs:
if: runner.os == 'Linux'
run: >-
mvn -B -pl server
-Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
-Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ActuatorOverrideExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
test
- name: Validate Windows deployment

4
server/src/main/config/test.properties
View File

@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
spring.freemarker.suffix = .ftl
# Spring Boot Actuator监控端点配置
management.endpoints.web.exposure.include = health,info,metrics
management.endpoint.health.show-details = always
management.endpoints.web.exposure.include = health
management.endpoint.health.show-details = never
management.health.defaults.enabled = true

2
server/src/main/java/cn/keking/service/CompressFileReader.java
View File

@@ -35,13 +35,13 @@ import java.util.List;
@Component
public class CompressFileReader {
private final FileHandlerService fileHandlerService;
private static final String fileDir = ConfigConstants.getFileDir();
public CompressFileReader(FileHandlerService fileHandlerService) {
this.fileHandlerService = fileHandlerService;
}
public String unRar(String filePath, String filePassword, String fileName, FileAttribute fileAttribute) throws Exception {
String fileDir = ConfigConstants.getFileDir();
List<String> imgUrls = new ArrayList<>();
String baseUrl = BaseUrlFilter.getBaseUrl();
String packagePath = "_";

9
server/src/test/java/cn/keking/config/ActuatorOverrideExposureSecurityTests.java Normal file
View File

@@ -0,0 +1,9 @@
package cn.keking.config;
import org.springframework.boot.test.context.SpringBootTest;
@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class,
properties = "spring.config.name=test",
webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
class ActuatorOverrideExposureSecurityTests extends ActuatorExposureSecurityTests {
}

26
server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java
View File

@@ -7,6 +7,7 @@ import org.junit.jupiter.api.io.TempDir;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;
@@ -17,18 +18,23 @@ class ArchiveTraversalSecurityTests {
@Test void existingExtractorRejectsZipSlipBeforeWritingOutsideArchive() throws Exception {
String previous = ConfigConstants.getFileDir();
ConfigConstants.setFileDirValue(temp.toString());
try {
Path archive = temp.resolve("malicious.zip");
try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
zip.write("BENIGN-CANARY".getBytes());
zip.closeEntry();
CompressFileReader reader = new CompressFileReader(null);
for (String directory : List.of("first", "second")) {
Path root = Files.createDirectory(temp.resolve(directory));
ConfigConstants.setFileDirValue(root.toString());
Path archive = root.resolve("malicious.zip");
try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
zip.write("BENIGN-CANARY".getBytes());
zip.closeEntry();
}
Exception error = assertThrows(Exception.class, () -> reader
.unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
assertTrue(Files.isDirectory(root.resolve("malicious.zip_")));
assertFalse(Files.exists(root.resolve("outside-marker.txt")));
}
Exception error = assertThrows(Exception.class, () -> new CompressFileReader(null)
.unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
assertFalse(Files.exists(temp.resolve("outside-marker.txt")));
} finally {
ConfigConstants.setFileDirValue(previous);
}