记录一次“任意文件下载”高危漏洞

最新推荐文章于 2024-08-02 11:14:14 发布

mylomen

最新推荐文章于 2024-08-02 11:14:14 发布

阅读量1k

点赞数

分类专栏： javaWeb 文章标签：漏洞

本文链接：https://blog.csdn.net/fangfengzhen115/article/details/50292645

版权

javaWeb 专栏收录该内容

14 篇文章 0 订阅

订阅专栏

<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
<%@page import="java.util.*"%>
<%@page import="java.io.*"%>
<%@page import="java.net.*"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <title>Demo Download</title>

    <meta http-equiv="pragma" content="no-cache">
    <meta http-equiv="cache-control" content="no-cache">
    <meta http-equiv="expires" content="0">    
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
    <meta http-equiv="description" content="This is my page">
    <!--
    <link rel="stylesheet" type="text/css" href="styles.css">
    -->

  </head>

  <body>
    <%
        String filename = "";
        if (request.getParameter("file") != null) {
            filename = request.getParameter("file");
        }
        response.setContentType("application/msword");
        response.setHeader("Content-disposition","attachment; filename="+filename);

        if("" != filename){
             BufferedInputStream bis = null;
            BufferedOutputStream bos = null;
            try {
                System.out.println("===============" + getServletContext().getRealPath("" + filename));
                bis = new BufferedInputStream(new FileInputStream(getServletContext().getRealPath("") + "/developerDemo/" + filename));
                bos = new BufferedOutputStream(response.getOutputStream());

                byte[] buff = new byte[2048];
                int bytesRead;

                while(-1 != (bytesRead = bis.read(buff, 0, buff.length))) {
                    bos.write(buff,0,bytesRead);
                }

            } catch(final IOException e) {
                System.out.println ( "出现IOException." + e );
            } finally {
                if (bis != null)
                    bis.close();
                if (bos != null)
                    bos.close();
            }
            return;
        }

    %>
  </body>
</html>