ZhouXY108/hutool
1
0
Fork 0
mirror of https://gitee.com/chinabugotech/hutool.git synced 2025-04-19 03:01:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复FileUtil.createTempFile可能导致的漏洞

Browse Source
This commit is contained in:
Looly 2023-05-15 20:47:54 +08:00
parent 2a5fa34fb8
commit 7312ee7e95
3 changed files with 41 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hutool-core/src/main/java/org/dromara/hutool/core/io/file/FileUtil.java
View File

@ -23,6 +23,7 @@ import org.dromara.hutool.core.io.unit.DataSizeUtil;
import org.dromara.hutool.core.lang.Assert;
import org.dromara.hutool.core.func.SerConsumer;
import org.dromara.hutool.core.func.SerFunction;
import org.dromara.hutool.core.lang.Console;
import org.dromara.hutool.core.net.url.URLUtil;
import org.dromara.hutool.core.reflect.ClassUtil;
import org.dromara.hutool.core.regex.ReUtil;
@ -890,10 +891,8 @@ public class FileUtil extends PathUtil {
* @throws IORuntimeException IO异常
*/
public static File createTempFile(final String prefix, final String suffix, final File dir, final boolean isReCreat) throws IORuntimeException {
int exceptionsCount = 0;
while (true) {
try {
final File file = File.createTempFile(prefix, suffix, mkdir(dir)).getCanonicalFile();
final File file = PathUtil.createTempFile(prefix, suffix, null == dir ? null : dir.toPath()).toFile().getCanonicalFile();
if (isReCreat) {
//noinspection ResultOfMethodCallIgnored
file.delete();
@ -901,11 +900,8 @@ public class FileUtil extends PathUtil {
file.createNewFile();
}
return file;
} catch (final IOException ioex) { // fixes java.io.WinNTFileSystem.createFileExclusively access denied
if (++exceptionsCount >= 50) {
throw new IORuntimeException(ioex);
}
}
} catch (final IOException e) { // fixes java.io.WinNTFileSystem.createFileExclusively access denied
throw new IORuntimeException(e);
}
}
// endregion

28
hutool-core/src/main/java/org/dromara/hutool/core/io/file/PathUtil.java
View File

@ -610,4 +610,32 @@ public class PathUtil {
}
return path.getFileName().toString();
}
/**
* 创建临时文件<br>
* 创建后的文件名为 prefix[Random].suffix From com.jodd.io.FileUtil
*
* @param prefix 前缀，至少3个字符
* @param suffix 后缀，如果null则使用默认.tmp
* @param dir 临时文件创建的所在目录
* @return 临时文件
* @throws IORuntimeException IO异常
* @since 6.0.0
*/
public static Path createTempFile(final String prefix, final String suffix, final Path dir) throws IORuntimeException {
int exceptionsCount = 0;
while (true) {
try {
if(null == dir){
return Files.createTempFile(prefix, suffix);
}else{
return Files.createTempFile(mkdir(dir), prefix, suffix);
}
} catch (final IOException ioex) { // fixes java.io.WinNTFileSystem.createFileExclusively access denied
if (++exceptionsCount >= 50) {
throw new IORuntimeException(ioex);
}
}
}
}
}

3
hutool-core/src/test/java/org/dromara/hutool/core/io/FileUtilTest.java
View File

@ -459,7 +459,7 @@ public class FileUtilTest {
}
@Test
@Disabled
//@Disabled
public void createTempFileTest(){
final File nullDirTempFile = FileUtil.createTempFile();
Assertions.assertTrue(nullDirTempFile.exists());
@ -468,6 +468,7 @@ public class FileUtilTest {
Assertions.assertEquals("xlsx", FileNameUtil.getSuffix(suffixDirTempFile));
final File prefixDirTempFile = FileUtil.createTempFile("prefix",".xlsx",true);
Console.log(prefixDirTempFile);
Assertions.assertTrue(FileNameUtil.getPrefix(prefixDirTempFile).startsWith("prefix"));
}