Java应用如何防止恶意文件上传

import org.springframework.web.multipart.MultipartFile;

public class FileUploadUtil {

    private static final Set<String> ALLOWED_IMAGE_EXTENSIONS = new HashSet<>(Arrays.asList("jpg", "jpeg", "png", "gif"));

    public static boolean isAllowedImageFile(MultipartFile file) {
        if (file == null || file.isEmpty()) {
            return false;
        }
        String fileExtension = getFileExtension(file.getOriginalFilename());
        return ALLOWED_IMAGE_EXTENSIONS.contains(fileExtension.toLowerCase());
    }

    private static String getFileExtension(String fileName) {
        if (fileName == null || fileName.isEmpty()) {
            return "";
        }
        int lastDotIndex = fileName.lastIndexOf('.');
        if (lastDotIndex == -1 || lastDotIndex == fileName.length() - 1) {
            return "";
        }
        return fileName.substring(lastDotIndex + 1);
    }
}

import org.apache.tika.detect Detector;
import org.apache.tika.metadata Metadata;
import org.apache.tika.mime MimeTypeException;
import org.apache.tika.mime MimeTypes;
import org.springframework.web.multipart.MultipartFile;

import java.io.IOException;
import java.io.InputStream;

public class FileContentTypeValidator {

    private static final MimeTypes MIME_TYPES = MimeTypes.getDefaultMimeTypes();
    private static final Set<String> ALLOWED_MIME_TYPES = new HashSet<>(Arrays.asList(
            "image/jpeg", "image/png", "application/pdf"
    ));

    public static boolean isValidContentType(MultipartFile file) {
        try (InputStream inputStream = file.getInputStream()) {
            Detector detector = new MimeTypesDetector(MIME_TYPES);
            Metadata metadata = new Metadata();
            String mimeType = detector.detect(inputStream, metadata).toString();
            return ALLOWED_MIME_TYPES.contains(mimeType.toLowerCase());
        } catch (IOException | MimeTypeException e) {
            return false;
        }
    }
}

import java.io.File;
import java.io.IOException;
import java.util.UUID;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import org.springframework.web.multipart.MultipartFile;

public class FileStorageService {

    private static final Path UPLOAD_DIR = Paths.get("uploads");

    public static Path storeFile(MultipartFile file) throws IOException {
        if (!Files.exists(UPLOAD_DIR)) {
            Files.createDirectories(UPLOAD_DIR);
        }
        String originalFilename = file.getOriginalFilename();
        if (originalFilename == null || originalFilename.isEmpty()) {
            return null;
        }
        String fileExtension = getFileExtension(originalFilename);
        String newFilename = UUID.randomUUID().toString() + "." + fileExtension;
        Path filePath = UPLOAD_DIR.resolve(newFilename);
        Files.copy(file.getInputStream(), filePath, StandardCopyOption.REPLACE_EXISTING);
        return filePath;
    }

    private static String getFileExtension(String fileName) {
        // 与之前示例中的 getFileExtension 方法类似
    }
}

// 在 Spring Boot 应用中，可在 application.properties 文件中进行配置
spring.servlet.multipart.max-file-size=10MB
spring.servlet.multipart.max-request-size=10MB

import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedMethods("GET", "POST", "OPTIONS")
                .allowedOrigins("*");
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
                .antMatchers("/api/file/upload").permitAll()
                .anyRequest().authenticated()
            .and()
            .httpBasic();
        return http.build();
    }
}