fix(llm): 过滤模型文件下载时的无后缀文件
- 在 ModelServiceServiceImpl 类中添加了对文件名进行过滤的逻辑 - 使用正则表达式匹配文件名,只保留包含后缀的文件 - 这个改动可以防止下载没有后缀的文件,提高文件下载的安全性
This commit is contained in:
parent
f7a501cc7d
commit
b8f8361ab1
@ -27,6 +27,7 @@ import org.springframework.validation.annotation.Validated;
|
||||
|
||||
import javax.annotation.Resource;
|
||||
import java.util.*;
|
||||
import java.util.regex.Pattern;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
|
||||
@ -313,6 +314,10 @@ public class ModelServiceServiceImpl implements ModelServiceService {
|
||||
List<String> res = new ArrayList<>();
|
||||
if (fileList != null){
|
||||
for (String fileName : fileList) {
|
||||
Pattern extensionPattern = Pattern.compile("\\.[a-zA-Z0-9]+$");
|
||||
if (!extensionPattern.matcher(fileName).find()){
|
||||
continue;
|
||||
}
|
||||
res.add(modelFileDownload + baseModelName +"/" + fileName);
|
||||
}
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user