From 080e1d7859f6ac1258141c45cb75c1e0440141c9 Mon Sep 17 00:00:00 2001 From: iizmg Date: Wed, 27 May 2020 16:31:36 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E8=AE=BF=E9=97=AE=E6=96=87?= =?UTF-8?q?=E4=BB=B6=E7=9A=84api=20,=20=E8=B0=83=E6=95=B4xss=E7=9A=84?= =?UTF-8?q?=E5=88=A4=E6=96=AD=E9=80=BB=E8=BE=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- admin/src/assets/favicon.ico | Bin 4286 -> 0 bytes .../api/general/web/FilePublicController.java | 65 ++++++++ .../main/resources/application-dev.properties | 1 + .../resources/application-prod.properties | 1 + .../org/itkk/udf/starter/core/CoreUtil.java | 4 + .../itkk/udf/starter/core/xss/XssUtil.java | 12 +- .../udf/starter/file/db/DbFileConstant.java | 7 + .../udf/starter/file/db/web/DbFileBase.java | 97 ++++++++++++ .../file/db/web/DbFileBaseController.java | 91 +---------- .../file/db/web/WopiBaseContrller.java | 148 ------------------ 10 files changed, 181 insertions(+), 245 deletions(-) delete mode 100644 admin/src/assets/favicon.ico create mode 100644 udf-api/udf-api-general/src/main/java/org/itkk/udf/api/general/web/FilePublicController.java create mode 100644 udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/DbFileBase.java delete mode 100644 udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/WopiBaseContrller.java diff --git a/admin/src/assets/favicon.ico b/admin/src/assets/favicon.ico deleted file mode 100644 index cdf5a8d28ca3e1d16d49c98fce1b1da76fac20dc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4286 zcmd515jesQ#$a#b#-eYGYkfV>PSMG$v-HfryHVECRC1zQmYl z5;ZZXm?&D5fExlvG)4quQCV%%nJm?GoJ^V8acp!rJ@36A40ZTOY=5*L^KkF?-pf7b zp65Kz`yeucKV!y-`Yom35xGr7e!}3AOk=2Z_rq(qhIrvEhyeJ%i0T!#>|0{V2a%SP zMOacAX3G07n6m9TLyDg^WYd#|yfx2|b#n}P^$}f)9@e$|S^D?0XXtliOxJEtovekf znyg8}uQiFC;FIWkeX{&+pG5t_CyVa%$->)x5;4vf^j$xUx8=}sOZG>R!ymS#*zV?`YY0X1A$N@PIXjna6>r0!a^(0Tx)+bE#-4jO+ zF~9W5GV+Kbk41O+B=U~n_#Y+NQX6B*VRAUI)RKxNrtFP0Wp}tGJHss5{=9L^mIcQ4 z&GQXxe8Rw+b9JnHOvjpsbrjClTn?G{Ye=7_A$hW|FL9!;B>q>vQ8D8^EtZnQVsZ$U z?~}=n)UCATNUSY~nTrF>*b!zz<>RyFeS9R)UbO*l%r!t?x*Q6qMb1nOnbd;5MDir9 zIFYpx48JYgFU_lMX-wIME3pFtos+L<&I#enSFPqr?dlU2ouKewSi{DzF zhmF58@W$ghUJK|@@F0DuI8Xq?hr#gAgajy~Yayx#`$alaND48J|sFYURG zoXK{iHPe>U8TP#mY4+9nWD6&fEF4oD;>clzmy60M6XlCce0`-oOx|o_O<2=8%=2r8d4m5oMhv8 zf(7~#)yxNd>E`3|mpv|i%Z?RbzXW>~eaYHjpLmOXVm&#mWqrP)dev;bBN%>Hp;X^w_1pm$zw2N=*e|hz^;r_Ajko8U*gzfF zFZ+G@>2UbxiyY}82kH>lo@ZY6|!#YS=n__F1j@CP_hht51_1hptUo9%#}Kr=Zsrc#Gw2gm6N)+dgx zx)qnY4&(FsZP=%3VFQ45dHw;HU`aIkjLEI-oB>PoO==f$~Jh zx*wzWk5%YBUxm{}V{x3lN_m3&hRZ?q?8+soXPZ^jVFdf-aQOY0gOBCp;N^lGdKlgL z{;xZ7oo?#zPsKrb!mSPZQq>0cF4R#6)vKyizg%j!R4%qh(GzMP9|nKGe}nOtdiVhi zikweapFbi8RU1E}4uAJ*L-~^RNe=a_QSRe7mSD4I+ed1m?a)KZY|d4-J6ADTLvrXU zbn$0VYwGW6uXv1L#Bi;i@ea@F2j?E1&s2SawNci=e6U}lmAy)FP_9#=*?ksVFvqT-|88zEgMcYB~yWRI6cyEO_gHc8-oyUHBb+=fpF`gXcOs3jHxsUhH63Lur61Pvr@B59Qt= zZQMh-cW|C?gr4wbJMtJl|L%K^;rrG7JHFc&2jlYGuX@8*yswe{K@>jwB|TvWIH-MG z%@U3`OE4d5#tw$xQ4m58a1S0b)HU~d1g}SV_k?_pYrQ;gQ`b5R{L;a?XwUP@InEMl zo?)+a=b0wz&_EvboN-V*MaM!fnE)$qdhYu9U@a1qx-xF zo=# 0) { + response.setHeader("Content-Disposition", "attachment;filename=" + fileName); + } else { + response.setHeader("Content-Disposition", "attachment;filename*=utf-8'zh_cn'" + fileName); + } + } + } +} diff --git a/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/DbFileBaseController.java b/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/DbFileBaseController.java index f667937..49cff6d 100644 --- a/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/DbFileBaseController.java +++ b/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/DbFileBaseController.java @@ -1,57 +1,16 @@ package org.itkk.udf.starter.file.db.web; -import org.apache.commons.collections4.MapUtils; -import org.apache.commons.lang3.StringUtils; -import org.itkk.udf.starter.core.CoreConstant; -import org.itkk.udf.starter.core.CoreProperties; import org.itkk.udf.starter.core.RestResponse; import org.itkk.udf.starter.core.exception.ParameterValidException; -import org.itkk.udf.starter.file.db.DbFileProperties; import org.itkk.udf.starter.file.db.dto.DbFileInfoDto; -import org.itkk.udf.starter.file.db.service.DbFileService; -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.web.bind.annotation.*; import org.springframework.web.multipart.MultipartFile; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; import java.io.IOException; -import java.io.UnsupportedEncodingException; -import java.net.URLEncoder; import java.util.List; import java.util.Map; -public abstract class DbFileBaseController { - - /** - * dbFileService - */ - @Autowired - private DbFileService dbFileService; - - /** - * dbFileProperties - */ - @Autowired - private DbFileProperties dbFileProperties; - - /** - * coreProperties - */ - @Autowired - private CoreProperties coreProperties; - - /** - * response - */ - @Autowired - private HttpServletResponse response; - - /** - * request - */ - @Autowired - private HttpServletRequest request; +public abstract class DbFileBaseController extends DbFileBase { /** * 获得当前用户ID @@ -144,52 +103,4 @@ public abstract class DbFileBaseController { dbFileService.delete(id); return RestResponse.success(); } - - /** - * 设置头信息 - * - * @param id id - * @param preview preview - * @throws UnsupportedEncodingException - */ - private void setResponseHeader(String id, Boolean preview) throws UnsupportedEncodingException { - //获得文件信息 - DbFileInfoDto fileInfo = dbFileService.get(id); - //判空 - if (fileInfo == null) { - throw new ParameterValidException("文件" + id + "不存在"); - } - //rootPath判空 - if (MapUtils.isEmpty(dbFileProperties.getMapping()) || !dbFileProperties.getMapping().containsKey(fileInfo.getRootPathCode())) { - throw new ParameterValidException("文件路径映射" + fileInfo.getRootPathCode() + "不存在"); - } - //清空response - response.reset(); - //设置response - response.setContentLengthLong(fileInfo.getFileSize()); - response.setCharacterEncoding(CoreConstant.CHARACTER_SET); - response.setContentType(fileInfo.getContentType()); - response.setDateHeader("Expires", 0L); - response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate"); - //response.addHeader("Cache-Control", "post-check=0, pre-check=0"); - response.setHeader("Pragma", "no-cache"); - //判断是否预览 (预览则要限定一下上下文类型){ - if (preview) { - if (StringUtils.isNotBlank(dbFileProperties.getPreviewSupportContentType())) { - if (!dbFileProperties.getPreviewSupportContentType().contains(fileInfo.getContentType())) { - throw new ParameterValidException("不支持[" + fileInfo.getContentType() + "]此上下文类型的预览"); - } - } - } - //判断是否预览 (预览则不用设置文件名) - if (!preview) { - //设置文件名 - String fileName = URLEncoder.encode(fileInfo.getFileName(), CoreConstant.CHARACTER_SET); - if (request.getHeader("User-Agent").toUpperCase().indexOf("MSIE") > 0) { - response.setHeader("Content-Disposition", "attachment;filename=" + fileName); - } else { - response.setHeader("Content-Disposition", "attachment;filename*=utf-8'zh_cn'" + fileName); - } - } - } } diff --git a/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/WopiBaseContrller.java b/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/WopiBaseContrller.java deleted file mode 100644 index e20a5c6..0000000 --- a/udf-starter/udf-starter-file-db/src/main/java/org/itkk/udf/starter/file/db/web/WopiBaseContrller.java +++ /dev/null @@ -1,148 +0,0 @@ -package org.itkk.udf.starter.file.db.web; - -import org.itkk.udf.starter.core.exception.SystemRuntimeException; -import org.itkk.udf.starter.file.db.dto.WopiFileInfo; -import org.itkk.udf.starter.file.db.service.DbFileService; -import org.apache.commons.codec.binary.Base64; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.RequestMapping; - -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.*; -import java.security.MessageDigest; - -public abstract class WopiBaseContrller { - - /** - * request - */ - @Autowired - private HttpServletRequest request; - - /** - * response - */ - @Autowired - private HttpServletResponse response; - - /** - * dbFileService - */ - @Autowired - private DbFileService dbFileService; - - /** - * 获取文件流 - * - * @param name - */ - @GetMapping("files/{name}/contents") - public void getFile(@PathVariable String name) { - final String utf8 = "UTF-8"; - final String iso88591 = "ISO-8859-1"; - InputStream fis = null; - OutputStream toClient = null; - try { - // 获得文件 - File file = dbFileService.getFile(name); - // 取得文件名 - String filename = file.getName(); - // 以流的形式下载文件 - fis = new BufferedInputStream(new FileInputStream(file)); - byte[] buffer = new byte[fis.available()]; - fis.read(buffer); - // 清空response - response.reset(); - // 设置response的Header - response.addHeader("Content-Disposition", "attachment;filename=" + new String(filename.getBytes(utf8), iso88591)); - response.addHeader("Content-Length", "" + file.length()); - toClient = new BufferedOutputStream(response.getOutputStream()); - response.setContentType("application/octet-stream"); - toClient.write(buffer); - toClient.flush(); - } catch (Exception e) { - throw new SystemRuntimeException(e); - } finally { - try { - if (fis != null) { - fis.close(); - } - if (toClient != null) { - toClient.close(); - } - } catch (Exception e) { - throw new SystemRuntimeException(e); - } - } - } - - /** - * 获取文件信息 - * - * @param name name - * @return WopiFileInfo - */ - @RequestMapping("files/{name}") - public WopiFileInfo getFileInfo(@PathVariable String name) { - //定义返回值 - WopiFileInfo info = null; - //获得文件 - File file = dbFileService.getFile(name); - //判空 - if (file.exists()) { - //实例化 - info = new WopiFileInfo(); - //填充文件信息 - info.setBaseFileName(file.getName()); - info.setSize(file.length()); - info.setOwnerId("admin"); - info.setVersion(file.lastModified()); - info.setSha256(getHash256(file)); - info.setAllowExternalMarketplace(false); - info.setUserCanWrite(false); - info.setSupportsUpdate(false); - info.setSupportsLocks(false); - info.setDisablePrint(true); - info.setDisableTranslation(true); - info.setUserCanNotWriteRelative(true); - } - //返回 - return info; - } - - /** - * 获取文件的SHA-256值 - * - * @param file file - * @return String - */ - private String getHash256(File file) { - String value = ""; - // 获取hash值 - try { - byte[] buffer = new byte[1024]; - int numRead; - InputStream fis = new FileInputStream(file); - //如果想使用SHA-1或SHA-256，则传入SHA-1,SHA-256 - MessageDigest complete = MessageDigest.getInstance("SHA-256"); - do { - //从文件读到buffer - numRead = fis.read(buffer); - if (numRead > 0) { - //用读到的字节进行MD5的计算，第二个参数是偏移量 - complete.update(buffer, 0, numRead); - } - } while (numRead != -1); - - fis.close(); - value = new String(Base64.encodeBase64(complete.digest())); - } catch (Exception e) { - throw new SystemRuntimeException(e); - } - return value; - } - -}