Apache Commons Fileupload Dos漏洞分析

dependencies {
/**
*omit other dependencies
*/
compile group: 'commons-fileupload', name: 'commons-fileupload', version: '1.3'
}

@RequestMapping(value="/fileupload")
publicString uploadFileHandler(HttpServletRequest request) {
boolean flag = false;
//判斷是否是檔案上傳請求
if(ServletFileUpload.isMultipartContent(request)){
// 建立檔案上傳處理器
DiskFileItemFactory factory = new DiskFileItemFactory();
ServletFileUpload upload = new ServletFileUpload(factory);
//限制單個上傳檔案的大小
upload.setFileSizeMax(1L<<24);
try {
List<FileItem> list = upload.parseRequest(request);
for (FileItem item : list) {
// 普通表單項
if (item.isFormField()) {
String name = item.getFieldName();
String value = item.getString("UTF-8");
System.out.println(name + " : " + value);
} else {// 檔案表單項
// 檔名
String fileName = item.getName();
// 生成唯一檔名
fileName = UUID.randomUUID().toString() + "#" + fileName;
// 獲取上傳路徑：專案目錄下的upload資料夾(先建立upload資料夾)
String basePath = request.getServletContext().getRealPath("/upload");
// 建立檔案物件
File file = new File(basePath, fileName);
// 寫檔案（儲存）
item.write(file);
// 刪除臨時檔案
item.delete();
}
}
} catch (FileUploadException e) {
System.out.println("上傳檔案過大");
} catch (IOException e) {
System.out.println("檔案讀取出現問題");
} catch (Exception e) {
e.printStackTrace();
}
}
return flag? "success":"error";
}

<form method="post" action="/fileupload" enctype="multipart/form-data">
選擇一個檔案:
<input type="file" name="uploadFile" />
<br/><br/>
<input type="submit" value="上傳" />
</form>

MultipartStream(InputStream input,
byte[] boundary,
int bufSize,
ProgressNotifier pNotifier) {
this.input = input;
this.bufSize = bufSize;
this.buffer = new byte[bufSize];
this.notifier = pNotifier;

// We prepend CR/LF to the boundary to chop trailing CR/LF from
// body-data tokens.
this.boundary = new byte[boundary.length + BOUNDARY_PREFIX.length];
this.boundaryLength = boundary.length + BOUNDARY_PREFIX.length;
this.keepRegion = this.boundary.length;
System.arraycopy(BOUNDARY_PREFIX, 0, this.boundary, 0,
BOUNDARY_PREFIX.length);
System.arraycopy(boundary, 0, this.boundary, BOUNDARY_PREFIX.length,
boundary.length);

head = 0;
tail = 0;
}

private int makeAvailable() throws IOException {
if (pos != -1) {
return 0;
}

// Move the data to the beginning of the buffer.
total += tail - head - pad;
System.arraycopy(buffer, tail - pad, buffer, 0, pad);

// Refill buffer with new data.
head = 0;
tail = pad;

for (;;) {
int bytesRead = input.read(buffer, tail, bufSize - tail);
if (bytesRead == -1) {
// The last pad amount is left in the buffer.
// Boundary can't be in there so signal an error
// condition.
final String msg = "Stream ended unexpectedly";
throw new MalformedStreamException(msg);
}
if (notifier != null) {
notifier.noteBytesRead(bytesRead);
}
tail += bytesRead;

findSeparator();
int av = available();

if (av > 0 || pos != -1) {
return av;
}
}
}