From c96fbe6b0aeb413a17c429133ee6d81d138144b9 Mon Sep 17 00:00:00 2001
From: liujie <1793218484@qq.com>
Date: 星期二, 09 六月 2026 10:58:52 +0800
Subject: [PATCH] Merge branch '1.0' of http://120.76.84.145:10101/gitblit/r/java/Robotaxi into 1.0
---
xp-robotaxi-operation-boot/src/main/java/com/xiaopeng/operation/controller/OssController.java | 30 ++++++++++++++++++++++++++++++
1 files changed, 30 insertions(+), 0 deletions(-)
diff --git a/xp-robotaxi-operation-boot/src/main/java/com/xiaopeng/operation/controller/OssController.java b/xp-robotaxi-operation-boot/src/main/java/com/xiaopeng/operation/controller/OssController.java
index c2e7fa4..e5b77ee 100644
--- a/xp-robotaxi-operation-boot/src/main/java/com/xiaopeng/operation/controller/OssController.java
+++ b/xp-robotaxi-operation-boot/src/main/java/com/xiaopeng/operation/controller/OssController.java
@@ -3,6 +3,7 @@
import cn.hutool.core.lang.UUID;
import com.xiaopeng.common.core.domain.R;
+import com.xiaopeng.common.core.exception.ServiceException;
import com.xiaopeng.evi.oss.service.AliOssService;
import com.xiaopeng.operation.vo.FileUploadVO;
import io.swagger.annotations.Api;
@@ -13,6 +14,9 @@
import javax.annotation.Resource;
import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
/**
* <p>
@@ -30,12 +34,37 @@
@Resource
private AliOssService aliOssService;
+ private static final Set<String> ALLOWED_IMAGE_TYPES = new HashSet<>(Arrays.asList(
+ ".jpg", ".jpeg", ".png", ".gif", ".bmp", ".webp", ".svg"
+ ));
+
+ /**
+ * 校验文件名安全性和图片类型
+ */
+ private void validateFileName(String fileName) throws IOException {
+ if (fileName == null || fileName.trim().isEmpty()) {
+ throw new IOException("文件名不能为空");
+ }
+ if (fileName.contains("../") || fileName.contains("..\\")) {
+ throw new IOException("文件名包含非法字符");
+ }
+ String fileExtension = "";
+ int lastDotIndex = fileName.lastIndexOf(".");
+ if (lastDotIndex > 0) {
+ fileExtension = fileName.substring(lastDotIndex).toLowerCase();
+ }
+ if (!ALLOWED_IMAGE_TYPES.contains(fileExtension)) {
+ throw new ServiceException("只允许上传图片文件，支持的类型：jpg, jpeg, png, gif, bmp, webp, svg");
+ }
+ }
+
@PostMapping(value = "/base/v1/oss/upload",headers = "content-type=multipart/form-data")
@ApiOperation(value = "文件上传",tags = "文件上传")
public R<FileUploadVO> uploadOSS(@RequestParam("file") MultipartFile file) {
try {
// 上传并返回访问地址
String fileName = file.getOriginalFilename();
+ validateFileName(fileName);
String prefix = fileName.substring(fileName.lastIndexOf("."));
long fileSize = file.getSize();
String fileId = UUID.randomUUID().toString();
@@ -67,6 +96,7 @@
try {
// 上传并返回访问地址
String fileName = file.getOriginalFilename();
+ validateFileName(fileName);
String prefix = fileName.substring(fileName.lastIndexOf("."));
long fileSize = file.getSize();
String fileId = UUID.randomUUID().toString();
--
Gitblit v1.7.1