opensource/cloudbeaver
3
0
Fork 0
mirror of https://github.com/dbeaver/cloudbeaver.git synced 2026-09-24 16:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3164 from dbeaver/CB-6085-fix-regex-in-web-sql-file-loader-servlet

Browse Source 
Cb 6085 fix regex in web sql file loader servlet
This commit is contained in:
DenisSinelnikov
2024-12-27 21:09:11 +04:00
committed by GitHub
parent ca83a1f167 882979e8c0
commit 3bcbf342c6
1 changed files with 16 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLFileLoaderServlet.java
+16 -15
View File
@@ -39,6 +39,7 @@ import java.lang.reflect.Type;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Map;
import java.util.UUID;
@MultipartConfig
public class WebSQLFileLoaderServlet extends WebServiceServletBase {
@@ -53,8 +54,6 @@ public class WebSQLFileLoaderServlet extends WebServiceServletBase {
private static final String FILE_ID = "fileId";
private static final String FORBIDDEN_CHARACTERS_FILE_REGEX = "(?U)[$()@ /]+";
private static final Gson gson = new GsonBuilder()
.serializeNulls()
.setPrettyPrinting()
@@ -89,19 +88,21 @@ public class WebSQLFileLoaderServlet extends WebServiceServletBase {
Map<String, Object> variables = gson.fromJson(request.getParameter(REQUEST_PARAM_VARIABLES), MAP_STRING_OBJECT_TYPE);
String fileId = JSONUtils.getString(variables, FILE_ID);
if (fileId != null && !fileId.matches(FORBIDDEN_CHARACTERS_FILE_REGEX) && !fileId.startsWith(".")) {
Path file = tempFolder.resolve(fileId);
try {
Files.write(file, request.getPart("fileData").getInputStream().readAllBytes());
} catch (ServletException e) {
log.error(e.getMessage());
throw new DBWebException(e.getMessage());
}
} else {
String illegalCharacters = fileId != null ?
fileId.replaceAll(FORBIDDEN_CHARACTERS_FILE_REGEX, " ").strip() : null;
throw new DBException("Resource path '" + fileId + "' contains illegal characters: " + illegalCharacters);
if (fileId == null) {
throw new DBWebException("File ID not found");
}
try {
// file id must be UUID
UUID.fromString(fileId);
} catch (IllegalArgumentException e) {
throw new DBWebException("File ID is invalid");
}
Path file = tempFolder.resolve(fileId);
try {
Files.write(file, request.getPart("fileData").getInputStream().readAllBytes());
} catch (ServletException e) {
log.error(e.getMessage());
throw new DBWebException(e.getMessage());
}
}
}