Remove permissions to upload file uploaded Java ee - Tomcat

Question

Remove permissions to upload file uploaded Java ee - Tomcat

Navigation

#1 by (0 votes)

0

I am trying to make a web with Java EE that allows uploading a file to the server and then downloading it. I have achieved both: Upload file to Java server ee

However, I am having a terrible safety hole. The files are uploaded to C: \ files But if I upload a .jsp file, for example, it is executed by the server. (Being able to make any kind of consultations!). What you need to know, is the correct way to upload the file, or edit the permissions, so this does not happen. So you can download files, but not run.

java-ee tomcat

asked by Facundo Curti 18.10.2016 в 01:07

source

1 answer

AreaSerie with 2 lines in WPF Differentiate a program with a HASH in QT

score 0 · Answer 1

I have found the solution. you have to make a servlet that is responsible for downloading the file. To do this you have to remove the servlet.xml path that you had added before.

Up:

    String subirArchivo(int codigo, HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException{
    Part filePart = request.getPart("archivo"); // Obtiene el archivo
    String fileName = Paths.get(filePart.getSubmittedFileName()).getFileName().toString(); // MSIE fix.

    if(!fileName.isEmpty()){
        String path="/archivos/";
        File uploads = new File(path); //Carpeta donde se guardan los archivos
        uploads.mkdirs(); //Crea los directorios necesarios
        File file = File.createTempFile("cod"+codigo+"-", "-"+fileName, uploads); //Evita que hayan dos archivos con el mismo nombre

        try (InputStream input = filePart.getInputStream()){
            Files.copy(input, file.toPath(), StandardCopyOption.REPLACE_EXISTING);
        }

        return file.getPath();
    }
    return null;
}

Post link:

if(adjunto!=null){
                String filename=adjunto.substring(10); //La longitud de /archivos/
                String borrar="<a href=borrarServlet?codigo="+codigo+"&comentario="+idComentario+"&file="+filename+"><img width=\"16\" src=images/borrar.png></img></a>";
                comentarios+="<tr><td>"+fecha+"</td>"+"<td>"+texto+"<br><a class=\"adj\" href=."+adjunto+">Descargar archivo</a></td><td>"+borrar+"</td></tr>";
            }

Download:

String filename = URLDecoder.decode(request.getPathInfo().substring(1), "UTF-8");
File file = new File("/archivos", filename);
response.setHeader("Content-Type", getServletContext().getMimeType(filename));
response.setHeader("Content-Length", String.valueOf(file.length()));
response.setHeader("Content-Disposition", "inline; filename=\"" + file.getName() + "\"");
Files.copy(file.toPath(), response.getOutputStream());