From 9d16b488109532d0fc44a8a4cb4b893396017924 Mon Sep 17 00:00:00 2001
From: xingyi <xingyi@dtstack.com>
Date: Tue, 21 Jul 2026 15:11:26 +0800
Subject: [PATCH] [feat-1202][taier-data-develop] check with upLoadController
 getResourceFromFiles file path #1202

---
 .../controller/console/UploadController.java  | 42 ++++++++++++++++---
 1 file changed, 36 insertions(+), 6 deletions(-)

diff --git a/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java b/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java
index 1d8ac9255f..6068b1ce03 100644
--- a/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java
+++ b/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/console/UploadController.java
@@ -43,6 +43,7 @@
 
 import javax.validation.constraints.NotNull;
 import java.io.File;
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -57,6 +58,8 @@ public class UploadController {
 
     private static String uploadsDir = System.getProperty("user.dir") + File.separator + "file-uploads";
 
+    private static final String INVALID_UPLOAD_FILE_NAME = "Invalid upload file name";
+
     @PostMapping(value="/component/config")
     @ApiOperation(value = "解析zip中xml或者json")
     public R<List<Object>> upload(@RequestParam("fileName") List<MultipartFile> files, @RequestParam("componentType") Integer componentType,
@@ -144,19 +147,46 @@ private List<Resource> getResourcesFromFiles(List<MultipartFile> files) {
         List<Resource> resources = new ArrayList<>(files.size());
         for (MultipartFile file : files) {
             String fileOriginalName = file.getOriginalFilename();
-            String path =  uploadsDir + File.separator + fileOriginalName;
-            File saveFile = new File(path);
-            if (!saveFile.getParentFile().exists()) {
-                saveFile.getParentFile().mkdirs();
-            }
+            String safeFileName = checkAndGetSafeFileName(fileOriginalName);
+            File saveFile = buildUploadFile(safeFileName);
             try {
                 file.transferTo(saveFile);
             } catch (Exception e) {
                 LOGGER.error("" , e);
                 throw new TaierDefineException("An error occurred while storing the file");
             }
-            resources.add(new Resource(fileOriginalName, path, (int) file.getSize(), file.getContentType(), file.getName()));
+            resources.add(new Resource(fileOriginalName, saveFile.getPath(), (int) file.getSize(), file.getContentType(), file.getName()));
         }
         return resources;
     }
+
+    private String checkAndGetSafeFileName(String fileOriginalName) {
+        if (StringUtils.isBlank(fileOriginalName)
+                || fileOriginalName.contains("/")
+                || fileOriginalName.contains("\\")
+                || fileOriginalName.contains("..")
+                || new File(fileOriginalName).isAbsolute()) {
+            throw new TaierDefineException(INVALID_UPLOAD_FILE_NAME);
+        }
+        return fileOriginalName;
+    }
+
+    private File buildUploadFile(String safeFileName) {
+        try {
+            File uploadBaseDir = new File(uploadsDir);
+            if (!uploadBaseDir.exists() && !uploadBaseDir.mkdirs()) {
+                throw new TaierDefineException("An error occurred while storing the file");
+            }
+            File saveFile = new File(uploadBaseDir, safeFileName);
+            String uploadBasePath = uploadBaseDir.getCanonicalPath();
+            String saveFilePath = saveFile.getCanonicalPath();
+            if (!saveFilePath.startsWith(uploadBasePath + File.separator)) {
+                throw new TaierDefineException(INVALID_UPLOAD_FILE_NAME);
+            }
+            return saveFile;
+        } catch (IOException e) {
+            LOGGER.error("Build upload file failed", e);
+            throw new TaierDefineException("An error occurred while storing the file");
+        }
+    }
 }