Skip to content

Commit b325b1a

Browse files
committed
Add compliant and noncompliant examples of java/unrestricted-file-upload@v1.0
1 parent 66d7cab commit b325b1a

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

src/java/detectors/unrestricted_file_upload/UnrestrictedFileUpload.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,14 @@
1212
import java.util.HashMap;
1313
import org.springframework.util.StringUtils;
1414
import javax.servlet.ServletException;
15+
import javax.servlet.http.Part;
16+
import java.nio.file.Files;
17+
import java.nio.file.StandardCopyOption;
1518

1619
public class UnrestrictedFileUpload {
1720

1821
// {fact rule=unrestricted-file-upload@v1.0 defects=1}
19-
public void unrestrictedFileUploadNoncompliant(HttpServletRequest request) {
22+
public void unrestrictedFileUploadNoncompliant(HttpServletRequest request, HttpServletResponse response) throws IOException {
2023
Part filePart = request.getPart("fileToUpload");
2124
InputStream fileInputStream = filePart.getInputStream();
2225
// Noncompliant: the uploaded file can have any extension.
@@ -27,7 +30,7 @@ public void unrestrictedFileUploadNoncompliant(HttpServletRequest request) {
2730
// {/fact}
2831

2932
// {fact rule=unrestricted-file-upload@v1.0 defects=0}
30-
public void unrestrictedFileUploadCompliant(HttpServletRequest request, HttpServletResponse response) {
33+
public void unrestrictedFileUploadCompliant(HttpServletRequest request, HttpServletResponse response) throws IOException {
3134
Part filePart = request.getPart("fileToUpload");
3235
// Compliant: the uploaded file must have one of the allowed extensions.
3336
if (filePart.getSubmittedFileName().endsWith(".jpg") || filePart.getSubmittedFileName().endsWith(".png")) {

0 commit comments

Comments
 (0)