Springboot 文件上传安全校验

应用中存在上传功能，但是上传的文件没有经过严格的合法性检验或者检验函数存在缺陷，导致可以上传木马文件到服务器。文件上传漏洞危害极大因为可以直接上传恶意代码到服务器上，可能会造成服务器的网页篡改、网站被挂马、服务器被远程控制、被安装后门等严重的后果。

校验的方法主要有：后缀名校验，文件头校验，若为图片可加透明的水印【暂未实现】

直接上代码

final static HashMap<String, String> fileHeadMap = new HashMap<>(); // 初始化文件头类型，不够的自行补充

final static int DEFAULT_CHECK_LENGTH = 3;

static {
        fileHeadMap.put("jpg", "ffd8ff");         

    fileHeadMap.put("jpeg", "ffd8ff");
        fileHeadMap.put("png", "89504e");
        fileHeadMap.put("gif", "474946");
        fileHeadMap.put("tif", "49492a");
        fileHeadMap.put("bmp", "424d22");
        fileHeadMap.put("dwg", "414331");
        fileHeadMap.put("html", "3c2144");
        fileHeadMap.put("htm", "3c2164");
        fileHeadMap.put("css", "48544d");
        fileHeadMap.put("js", "696b2e");
        fileHeadMap.put("rtf", "7b5c72");
        fileHeadMap.put("psd", "384250");
        fileHeadMap.put("eml", "46726f");
        fileHeadMap.put("mdb", "537461");
        fileHeadMap.put("ps", "252150");
        fileHeadMap.put("pdf", "255044");
        fileHeadMap.put("rmvb", "2e524d");
        fileHeadMap.put("flv", "464c56");
        fileHeadMap.put("mp4", "000000");
        fileHeadMap.put("mp3", "494433");
        fileHeadMap.put("mpg", "000001");
        fileHeadMap.put("wmv", "3026b2");
        fileHeadMap.put("mid", "4d5468");
        fileHeadMap.put("zip", "504b03");
        fileHeadMap.put("rar", "526172");
        fileHeadMap.put("ini", "235468");
        fileHeadMap.put("exe", "4d5a90");
        fileHeadMap.put("jsp", "3c2540");
        fileHeadMap.put("mf", "4d616e");
        fileHeadMap.put("xml", "3c3f78");
        fileHeadMap.put("sql", "494e53");
        fileHeadMap.put("java", "706163");
        fileHeadMap.put("bat", "406563");
        fileHeadMap.put("gz", "1f8b08");
        fileHeadMap.put("properties", "6c6f67");
        fileHeadMap.put("class", "cafeba");
        fileHeadMap.put("chm", "495453");
        fileHeadMap.put("mxp", "040000");
        fileHeadMap.put("doc", "d0cf11");
        fileHeadMap.put("docx", "504b03");
}

/**
* 通过文件头魔数获取文件类型
* @param inputStream 文件流
* @return 返回文件头
*/
public static String getFileTypeByMagicNumber(InputStream inputStream) {
        byte[] bytes = new byte[DEFAULT_CHECK_LENGTH];
        try { // 获取文件头前三位魔数的二进制
                inputStream.read(bytes, 0, bytes.length); // 文件头前三位魔数二进制转为16进制
                String code = bytesToHexString(bytes);
                log.info("文件头：{}", code);
                return code;
        } catch (IOException e) {
                log.error("获取文件头失败：{}", e.getMessage());
                e.printStackTrace();
        }
        return "";
}

/**
* 字节数组转为16进制
* @param bytes 字节数组
* @return 返回字符串
*/
public static String bytesToHexString(byte[] bytes) {
StringBuilder stringBuilder = new StringBuilder();
for (int i = 0; i < bytes.length; i++) {
int v = bytes[i] & 0xFF;
String hv = Integer.toHexString(v);
if (hv.length() < 2) {
stringBuilder.append(0);
}
stringBuilder.append(hv);
}
return stringBuilder.toString();
}

/**
* 通过文件名获取文件后缀名
* @param fileName 文件名
* @return 文件后缀名
*/
public static String getFileTypeBySuffix(String fileName) {
if (StringUtils.isBlank(fileName)) {
return "";
}
int lastIndex = fileName.lastIndexOf(".");
if (lastIndex == -1) {
return "";
}
return fileName.substring(lastIndex + 1, fileName.length());
}