附件上传的bug【转】

以下为同事建议的处理方法：
很多项目中都把附件上传到webRoot目录下的某一个目录（没有限制上传文件），这样系统就增加了一个安全漏洞，上传一个JSP,就可以做任何操作。处理方案是限制这些目录的JSP直接访问.

操作如下，在web.xml最前面配置一个过滤器:

    <filter>
       <filter-name>jsplimitaccessfilter</filter-name>
       <filter-class>com.xx.JspLimitAccessFilter</filter-class>
       <init-param>
          <param-name>limitpaths</param-name>
          <param-value>/upload/</param-value>
       </init-param>
    </filter>
 
    <filter-mapping>
       <filter-name>jsplimitaccessfilter</filter-name>
       <url-pattern>*.jsp</url-pattern>
    </filter-mapping>

JspLimitAccessFilter代码如下：

package com.xx;

import java.io.IOException;
import java.util.HashSet;
import java.util.Set;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import com.xx.pub.util.Tools;

public class JspLimitAccessFilter implements Filter {
	
	private String limitpath="/upload/";
	private Set<String> limitspath=new HashSet<String>();

	
	public void destroy() {
	}

	
	public void doFilter(ServletRequest arg0, ServletResponse arg1,
			FilterChain arg2) throws IOException, ServletException {
		HttpServletRequest request=(HttpServletRequest)arg0;
		String url=request.getRequestURI();
		for(String s: limitspath){
			if(url.indexOf(s)!=-1){
				return;
			}
		}
		arg2.doFilter(arg0, arg1);

	}

	
	public void init(FilterConfig arg0) throws ServletException {
		String limits=arg0.getInitParameter("limitpaths");
		if(Tools.isNull(limits)){
			limits = limitpath;
		}
		String [] ls=limits.split(";");
		for(String s: ls){
			limitspath.add(s);
		}
	}

}

来自ucap liuhf
--------------------
也有另外一个解决方案，就是限制文件上传的格式；