Apache Commons Fileupload Dos漏洞分析

dependencies {
    /**
     *  omit other dependencies
     */
    compile group: 'commons-fileupload', name: 'commons-fileupload', version: '1.3'
}

@RequestMapping(value="/fileupload")
public  String uploadFileHandler(HttpServletRequest request) {
    boolean flag = false;
    //判断是否是文件上传请求
    if(ServletFileUpload.isMultipartContent(request)){
        // 创建文件上传处理器
        DiskFileItemFactory factory = new DiskFileItemFactory();
        ServletFileUpload upload = new ServletFileUpload(factory);
        //限制单个上传文件的大小
        upload.setFileSizeMax(1L<<24);
        try {
            List<FileItem> list = upload.parseRequest(request);
            for (FileItem item : list) {
                // 普通表单项
                if (item.isFormField()) {
                    String name = item.getFieldName();
                    String value = item.getString("UTF-8");
                    System.out.println(name + " : " + value);
                } else {// 文件表单项
                    // 文件名
                    String fileName = item.getName();
                    // 生成唯一文件名
                    fileName = UUID.randomUUID().toString() + "#" + fileName;
                    // 获取上传路径：项目目录下的upload文件夹(先创建upload文件夹)
                    String basePath = request.getServletContext().getRealPath("/upload");
                    // 创建文件对象
                    File file = new File(basePath, fileName);
                    // 写文件（保存）
                    item.write(file);
                    // 删除临时文件
                    item.delete();
                }
            }
        } catch (FileUploadException e) {
            System.out.println("上传文件过大");
        } catch (IOException e) {
            System.out.println("文件读取出现问题");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
    return flag? "success":"error";
}

<form method="post" action="/fileupload" enctype="multipart/form-data">
    选择一个文件:
    <input type="file" name="uploadFile" />
    <br/><br/>
    <input type="submit" value="上传" />
</form>

MultipartStream(InputStream input,
        byte[] boundary,
        int bufSize,
        ProgressNotifier pNotifier) {
    this.input = input;
    this.bufSize = bufSize;
    this.buffer = new byte[bufSize];
    this.notifier = pNotifier;

    // We prepend CR/LF to the boundary to chop trailing CR/LF from
    // body-data tokens.
    this.boundary = new byte[boundary.length + BOUNDARY_PREFIX.length];
    this.boundaryLength = boundary.length + BOUNDARY_PREFIX.length;
    this.keepRegion = this.boundary.length;
    System.arraycopy(BOUNDARY_PREFIX, 0, this.boundary, 0,
            BOUNDARY_PREFIX.length);
    System.arraycopy(boundary, 0, this.boundary, BOUNDARY_PREFIX.length,
            boundary.length);

    head = 0;
    tail = 0;
}

private int makeAvailable() throws IOException {
    if (pos != -1) {
        return 0;
    }

    // Move the data to the beginning of the buffer.
    total += tail - head - pad;
    System.arraycopy(buffer, tail - pad, buffer, 0, pad);

    // Refill buffer with new data.
    head = 0;
    tail = pad;

    for (;;) {
        int bytesRead = input.read(buffer, tail, bufSize - tail);
        if (bytesRead == -1) {
            // The last pad amount is left in the buffer.
            // Boundary can't be in there so signal an error
            // condition.
            final String msg = "Stream ended unexpectedly";
            throw new MalformedStreamException(msg);
        }
        if (notifier != null) {
            notifier.noteBytesRead(bytesRead);
        }
        tail += bytesRead;

        findSeparator();
        int av = available();

        if (av > 0 || pos != -1) {
            return av;
        }
    }
}