xinyin025/RuoYi-Vue-Plus
1
0
Fork 0
mirror of https://github.com/dromara/RuoYi-Vue-Plus.git synced 2025-11-04 16:23:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix 修复 有某些无聊人士 对一个demo案例提漏洞 CVE-2025-6925

Browse Source 
Signed-off-by: 疯狂的狮子Li <15040126243@163.com>
This commit is contained in:
疯狂的狮子Li
2025-07-04 01:10:49 +00:00
committed by Gitee
parent 64100cf1ff
commit fd5d028e95
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ruoyi-modules/ruoyi-demo/src/main/java/org/dromara/demo/controller/MailController.java
View File

@@ -1,6 +1,5 @@
package org.dromara.demo.controller;
import cn.dev33.satoken.annotation.SaIgnore;
import lombok.RequiredArgsConstructor;
import org.dromara.common.core.domain.R;
import org.dromara.common.mail.utils.MailUtils;
@@ -18,7 +17,6 @@ import java.util.Arrays;
*
* @author Michelle.Chung
*/
@SaIgnore
@Validated
@RequiredArgsConstructor
@RestController
@@ -44,11 +42,11 @@ public class MailController {
* @param to 接收人
* @param subject 标题
* @param text 内容
* @param filePath 附件路径
*/
@GetMapping("/sendMessageWithAttachment")
public R<Void> sendMessageWithAttachment(String to, String subject, String text, String filePath) {
MailUtils.sendText(to, subject, text, new File(filePath));
public R<Void> sendMessageWithAttachment(String to, String subject, String text) {
// 附件路径 禁止前端传递 有任意读取系统文件风险
MailUtils.sendText(to, subject, text, new File("/xxx/xxx"));
return R.ok();
}
@@ -58,10 +56,11 @@ public class MailController {
* @param to 接收人
* @param subject 标题
* @param text 内容
* @param paths 附件路径
*/
@GetMapping("/sendMessageWithAttachments")
public R<Void> sendMessageWithAttachments(String to, String subject, String text, String[] paths) {
public R<Void> sendMessageWithAttachments(String to, String subject, String text) {
// 附件路径 禁止前端传递 有任意读取系统文件风险
String[] paths = new String[]{"/xxx/xxx", "/xxx/xxx"};
File[] array = Arrays.stream(paths).map(File::new).toArray(File[]::new);
MailUtils.sendText(to, subject, text, array);
return R.ok();