diff --git a/CHANGELOG.md b/CHANGELOG.md index fdbddc0ec..dcceca6e2 100755 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ * 【core 】 修复umberUtil.parseNumber对+解析问题(issue#I79VS7@Gitee) * 【core 】 修复IdcardUtil.getGenderByIdCard存在潜在的异常(pr#1007@Gitee) * 【core 】 修复Table#contains空指针问题(issue#3135@Gitee) +* 【core 】 修复FileUtil.checkSlip方法缺陷 ------------------------------------------------------------------------------------------------------------- # 5.8.19(2023-05-27) diff --git a/hutool-core/src/main/java/cn/hutool/core/io/FileUtil.java b/hutool-core/src/main/java/cn/hutool/core/io/FileUtil.java index 46ca92879..9750fc445 100755 --- a/hutool-core/src/main/java/cn/hutool/core/io/FileUtil.java +++ b/hutool-core/src/main/java/cn/hutool/core/io/FileUtil.java @@ -3459,18 +3459,7 @@ public class FileUtil extends PathUtil { */ public static File checkSlip(File parentFile, File file) throws IllegalArgumentException { if (null != parentFile && null != file) { - String parentCanonicalPath; - String canonicalPath; - try { - parentCanonicalPath = parentFile.getCanonicalPath(); - canonicalPath = file.getCanonicalPath(); - } catch (IOException e) { - // issue#I4CWMO@Gitee - // getCanonicalPath有时会抛出奇怪的IO异常,此时忽略异常,使用AbsolutePath判断。 - parentCanonicalPath = parentFile.getAbsolutePath(); - canonicalPath = file.getAbsolutePath(); - } - if (false == canonicalPath.startsWith(parentCanonicalPath)) { + if(!file.toPath().startsWith(parentFile.toPath())){ throw new IllegalArgumentException("New file is outside of the parent dir: " + file.getName()); } } diff --git a/hutool-core/src/test/java/cn/hutool/core/io/FileUtilTest.java b/hutool-core/src/test/java/cn/hutool/core/io/FileUtilTest.java index 2bbf4b5d1..a0f2a197f 100644 --- a/hutool-core/src/test/java/cn/hutool/core/io/FileUtilTest.java +++ b/hutool-core/src/test/java/cn/hutool/core/io/FileUtilTest.java @@ -532,4 +532,11 @@ public class FileUtilTest { // 当复制文件到目标目录的时候,返回复制的目标文件,而非目录 Console.log(copy); } + + @Test + public void checkSlipTest() { + Assert.assertThrows(IllegalArgumentException.class, ()->{ + FileUtil.checkSlip(FileUtil.file("test/a"), FileUtil.file("test/../a")); + }); + } }