File tree Expand file tree Collapse file tree 1 file changed +5
-2
lines changed
src/java/detectors/unrestricted_file_upload Expand file tree Collapse file tree 1 file changed +5
-2
lines changed Original file line number Diff line number Diff line change 12
12
import java .util .HashMap ;
13
13
import org .springframework .util .StringUtils ;
14
14
import javax .servlet .ServletException ;
15
+ import javax .servlet .http .Part ;
16
+ import java .nio .file .Files ;
17
+ import java .nio .file .StandardCopyOption ;
15
18
16
19
public class UnrestrictedFileUpload {
17
20
18
21
// {fact rule=unrestricted-file-upload@v1.0 defects=1}
19
- public void unrestrictedFileUploadNoncompliant (HttpServletRequest request ) {
22
+ public void unrestrictedFileUploadNoncompliant (HttpServletRequest request , HttpServletResponse response ) throws IOException {
20
23
Part filePart = request .getPart ("fileToUpload" );
21
24
InputStream fileInputStream = filePart .getInputStream ();
22
25
// Noncompliant: the uploaded file can have any extension.
@@ -27,7 +30,7 @@ public void unrestrictedFileUploadNoncompliant(HttpServletRequest request) {
27
30
// {/fact}
28
31
29
32
// {fact rule=unrestricted-file-upload@v1.0 defects=0}
30
- public void unrestrictedFileUploadCompliant (HttpServletRequest request , HttpServletResponse response ) {
33
+ public void unrestrictedFileUploadCompliant (HttpServletRequest request , HttpServletResponse response ) throws IOException {
31
34
Part filePart = request .getPart ("fileToUpload" );
32
35
// Compliant: the uploaded file must have one of the allowed extensions.
33
36
if (filePart .getSubmittedFileName ().endsWith (".jpg" ) || filePart .getSubmittedFileName ().endsWith (".png" )) {
You can’t perform that action at this time.
0 commit comments