public/dataease
1
0
Fork 0
mirror of https://github.com/dataease/dataease.git synced 2026-06-12 08:21:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: 修复任意文件上传漏洞

Browse Source
This commit is contained in:
taojinlong
2024-03-05 10:42:44 +08:00
parent c8bdeaaf12
commit 6b68ace139
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/backend/src/main/java/io/dataease/service/sys/PluginService.java
View File

@@ -65,7 +65,7 @@ public class PluginService {
}
private void checkFileName(String fileName){
if(StringUtils.isEmpty(fileName) || !fileName.endsWith(".jar") || fileName.contains("../")){
if(StringUtils.isEmpty(fileName) || !fileName.endsWith(".zip") || fileName.contains("../")){
DataEaseException.throwException("非法的文件名: " + fileName);
}
}