Skip to content

Commit

Permalink
Add compliant and noncompliant examples of java/unrestricted-file-upl…
Browse files Browse the repository at this point in the history
…oad@v1.0
  • Loading branch information
karmakri committed Dec 14, 2023
1 parent a618181 commit 27c006a
Showing 1 changed file with 3 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,14 @@
import javax.servlet.ServletException;
import javax.servlet.http.Part;
import java.io.IOException;
import javax.servlet.ServletException;
import java.nio.file.Files;
import java.nio.file.StandardCopyOption;

public class UnrestrictedFileUpload {

// {fact rule=unrestricted-file-upload@v1.0 defects=1}
public void unrestrictedFileUploadNoncompliant(HttpServletRequest request, HttpServletResponse response) throws IOException {
public void unrestrictedFileUploadNoncompliant(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
Part filePart = request.getPart("fileToUpload");
InputStream fileInputStream = filePart.getInputStream();
// Noncompliant: the uploaded file can have any extension.
Expand All @@ -31,7 +32,7 @@ public void unrestrictedFileUploadNoncompliant(HttpServletRequest request, HttpS
// {/fact}

// {fact rule=unrestricted-file-upload@v1.0 defects=0}
public void unrestrictedFileUploadCompliant(HttpServletRequest request, HttpServletResponse response) throws IOException {
public void unrestrictedFileUploadCompliant(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
Part filePart = request.getPart("fileToUpload");
// Compliant: the uploaded file must have one of the allowed extensions.
if (filePart.getSubmittedFileName().endsWith(".jpg") || filePart.getSubmittedFileName().endsWith(".png")) {
Expand Down

0 comments on commit 27c006a

Please sign in to comment.