From fb551beb3fcfb89f0c306e0a863bd5dc3fb07a47 Mon Sep 17 00:00:00 2001 From: sh Date: Fri, 26 Jun 2026 10:56:21 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E6=96=87=E4=BB=B6=E4=B8=8A?= =?UTF-8?q?=E4=BC=A0=E8=A7=86=E9=A2=91=E7=B1=BB=E5=9E=8B=E5=88=A4=E6=96=AD?= =?UTF-8?q?=E2=80=94=E2=80=94=E4=BF=AE=E6=94=B9=E4=B8=8A=E4=BC=A0=E6=8A=A5?= =?UTF-8?q?=E9=94=99=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/resources/application-dev.yml | 4 +- .../src/main/resources/application-prod.yml | 4 +- .../cms/CmsFileJobUploadController.java | 2 +- .../com/ruoyi/cms/util/file/FileValid.java | 98 ++++++++++++++++--- 4 files changed, 88 insertions(+), 20 deletions(-) diff --git a/ruoyi-admin/src/main/resources/application-dev.yml b/ruoyi-admin/src/main/resources/application-dev.yml index 9e38a2a..b2dc60b 100644 --- a/ruoyi-admin/src/main/resources/application-dev.yml +++ b/ruoyi-admin/src/main/resources/application-dev.yml @@ -56,9 +56,9 @@ spring: servlet: multipart: # 单个文件大小 - max-file-size: 10MB + max-file-size: 1024MB # 设置总上传的文件大小 - max-request-size: 20MB + max-request-size: 2048MB # 服务模块 devtools: restart: diff --git a/ruoyi-admin/src/main/resources/application-prod.yml b/ruoyi-admin/src/main/resources/application-prod.yml index ae80d59..f89adb2 100644 --- a/ruoyi-admin/src/main/resources/application-prod.yml +++ b/ruoyi-admin/src/main/resources/application-prod.yml @@ -55,9 +55,9 @@ spring: servlet: multipart: # 单个文件大小 - max-file-size: 10MB + max-file-size: 1024MB # 设置总上传的文件大小 - max-request-size: 20MB + max-request-size: 2048MB # 服务模块 devtools: restart: diff --git a/ruoyi-bussiness/src/main/java/com/ruoyi/cms/controller/cms/CmsFileJobUploadController.java b/ruoyi-bussiness/src/main/java/com/ruoyi/cms/controller/cms/CmsFileJobUploadController.java index 85329c1..fc7e464 100644 --- a/ruoyi-bussiness/src/main/java/com/ruoyi/cms/controller/cms/CmsFileJobUploadController.java +++ b/ruoyi-bussiness/src/main/java/com/ruoyi/cms/controller/cms/CmsFileJobUploadController.java @@ -25,7 +25,7 @@ public class CmsFileJobUploadController extends BaseController { private IFileJobUploadService fileJobUploadService; //文件大小限制 10MB - private static final long MAX_FILE_SIZE = 100 * 1024 * 1024; + private static final long MAX_FILE_SIZE = 1024 * 1024 * 1024; @ApiOperation("上传文件") @PreAuthorize("@ss.hasPermi('cms:fileJobUpload:upload')") diff --git a/ruoyi-bussiness/src/main/java/com/ruoyi/cms/util/file/FileValid.java b/ruoyi-bussiness/src/main/java/com/ruoyi/cms/util/file/FileValid.java index 27791b0..8ac6ecc 100644 --- a/ruoyi-bussiness/src/main/java/com/ruoyi/cms/util/file/FileValid.java +++ b/ruoyi-bussiness/src/main/java/com/ruoyi/cms/util/file/FileValid.java @@ -2,6 +2,8 @@ package com.ruoyi.cms.util.file; import org.springframework.web.multipart.MultipartFile; +import java.io.IOException; +import java.io.InputStream; import java.util.Arrays; import java.util.List; @@ -32,7 +34,16 @@ public class FileValid { "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-powerpoint", - "application/vnd.openxmlformats-officedocument.presentationml.presentation" + "application/vnd.openxmlformats-officedocument.presentationml.presentation", + //视频 + "video/mp4", + "video/x-msvideo", // avi + "video/quicktime", // mov + "video/x-matroska", // mkv + "video/x-flv", // flv + "video/x-ms-wmv", // wmv + "video/webm", // webm + "video/x-m4v" // m4v ); /** @@ -51,22 +62,35 @@ public class FileValid { * @return */ public static boolean validateFile(MultipartFile file) { - try { - // 白名单配置 - - String originalFilename = file.getOriginalFilename().toLowerCase(); - String contentType = file.getContentType(); - String ext = originalFilename.substring(originalFilename.lastIndexOf(".") + 1); - - // 扩展名 + MIME 校验 - if (!allowedExt.contains(ext) || !allowedMime.contains(contentType)) { - return false; - } - - return true; - } catch (Exception e) { + if (file == null || file.isEmpty()) { return false; } + // 白名单配置 + String originalFilename = file.getOriginalFilename().toLowerCase(); + String contentType = file.getContentType(); + if (originalFilename == null || !originalFilename.contains(".")) { + return false; + } + String ext = originalFilename.substring(originalFilename.lastIndexOf(".") + 1); + + // 扩展名 + MIME 校验 + if (!allowedExt.contains(ext) || !allowedMime.contains(contentType)) { + return false; + } + try (InputStream is = file.getInputStream()) { + byte[] header = new byte[16]; + int read = is.read(header); + if (read <= 0) { + return false; + } + String fileMagic = bytesToHex(header); + if (!matchMagicByExt(ext, fileMagic)) { + return false; + } + } catch (IOException e) { + return false; + } + return true; } /** @@ -82,4 +106,48 @@ public class FileValid { return sb.toString(); } + /** + * 根据后缀匹配合法魔数（视频魔数已补充） + */ + private static boolean matchMagicByExt(String ext, String magic) { + switch (ext) { + // 图片 + case "jpg": + case "jpeg": + return magic.startsWith("FFD8FF"); + case "png": + return magic.startsWith("89504E47"); + case "gif": + return magic.startsWith("47494638"); + // PDF + case "pdf": + return magic.startsWith("25504446"); + // Office文档 + case "doc": + return magic.startsWith("D0CF11E0"); + case "docx": + case "xlsx": + case "pptx": + return magic.startsWith("504B0304"); + // 视频 mp4/mov/m4v + case "mp4": + case "mov": + case "m4v": + return magic.contains("6D6F6F76") || magic.contains("66747970"); + // mkv + case "mkv": + return magic.startsWith("1A45DFA3"); + // avi + case "avi": + return magic.startsWith("52494646") && magic.contains("41564920"); + // flv + case "flv": + return magic.startsWith("464C5601"); + // webm + case "webm": + return magic.startsWith("1A45DFA3"); + default: + return false; + } + } }