package net.radar.util;

import java.util.regex.Pattern;

public class PreventTraversalUtil {

private static Pattern FilePattern = Pattern.compile("[\\\\/:*?\"<>|]");

/**

* 路径遍历 漏洞修复

* @param str

* @return

*/

protected static String filenameFilter(String str) {

return str==null?null:FilePattern.matcher(str).replaceAll("");

}

}

调用

/**

* 根据PageTemplateConfig对象读取模板文件内容

*

* @return 模板文件内容

*/

public static String readTemplateFileContent(PageTemplateConfig pageTemplateConfig) {

String filenameFilter = PreventTraversalUtil.filenameFilter(CommonUtil.getWebRootPath() + pageTemplateConfig.getTemplatePath());

File templateFile = new File(filenameFilter);

// File templateFile = new File(CommonUtil.getWebRootPath() + pageTemplateConfig.getTemplatePath());

String templateFileContent = null;

try {

templateFileContent = FileUtils.readFileToString(templateFile, "UTF-8");

} catch (IOException e) {

e.printStackTrace();

}

return templateFileContent;

}