open-source/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2026-03-30 13:03:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): set UTF-8 deny response and use Locale.ROOT

Browse Source
This commit is contained in:
kl
2026-03-03 14:18:41 +08:00
parent 5ba88d1243
commit a20606bf33
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
server/src/main/java/cn/keking/web/filter/TrustHostFilter.java
View File

@@ -5,6 +5,7 @@ import cn.keking.utils.WebUtils;
import java.io.IOException; import java.io.IOException;
import java.util.Map; import java.util.Map;
import java.util.Locale;
import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentHashMap;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Set; import java.util.Set;
@@ -50,8 +51,10 @@ public class TrustHostFilter implements Filter {
String host = WebUtils.getHost(url); String host = WebUtils.getHost(url);
if (isNotTrustHost(host)) { if (isNotTrustHost(host)) {
String currentHost = host == null ? "UNKNOWN" : host; String currentHost = host == null ? "UNKNOWN" : host;
response.setCharacterEncoding(StandardCharsets.UTF_8.name());
response.setContentType("text/html;charset=UTF-8");
String html = this.notTrustHostHtmlView == null String html = this.notTrustHostHtmlView == null
? "<html><body>当前预览文件来自不受信任的站点：" + currentHost + "</body></html>" ? "<html><head><meta charset=\"utf-8\"></head><body>当前预览文件来自不受信任的站点：" + currentHost + "</body></html>"
: this.notTrustHostHtmlView.replace("${current_host}", currentHost); : this.notTrustHostHtmlView.replace("${current_host}", currentHost);
response.getWriter().write(html); response.getWriter().write(html);
response.getWriter().close(); response.getWriter().close();
@@ -88,7 +91,7 @@ public class TrustHostFilter implements Filter {
} }
private boolean matchAnyPattern(String host, Set<String> hostPatterns) { private boolean matchAnyPattern(String host, Set<String> hostPatterns) {
String normalizedHost = host.toLowerCase(); String normalizedHost = host.toLowerCase(Locale.ROOT);
for (String hostPattern : hostPatterns) { for (String hostPattern : hostPatterns) {
if (matchHostPattern(normalizedHost, hostPattern)) { if (matchHostPattern(normalizedHost, hostPattern)) {
return true; return true;
@@ -107,7 +110,7 @@ public class TrustHostFilter implements Filter {
if (hostPattern == null || hostPattern.trim().isEmpty()) { if (hostPattern == null || hostPattern.trim().isEmpty()) {
return false; return false;
} }
String pattern = hostPattern.trim().toLowerCase(); String pattern = hostPattern.trim().toLowerCase(Locale.ROOT);
if ("*".equals(pattern)) { if ("*".equals(pattern)) {
return true; return true;