v5.0.2
2026-08-14
- 最新稳定版本
+ 上一补丁版本
建议尽快升级
diff --git a/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java b/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java
new file mode 100644
index 000000000..792aa31bb
--- /dev/null
+++ b/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java
@@ -0,0 +1,30 @@
+package cn.keking.config;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class,
+ webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class ActuatorExposureSecurityTests {
+ @Configuration(proxyBeanMethods = false)
+ @EnableAutoConfiguration
+ static class ManagementApp { }
+
+ @Autowired TestRestTemplate http;
+
+ @Test void shippedDefaultsExposeOnlyAnAggregateHealthStatus() {
+ var health = http.getForEntity("/actuator/health", String.class);
+ assertEquals(HttpStatus.OK, health.getStatusCode());
+ assertEquals("{\"status\":\"UP\"}", health.getBody());
+ assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/info", String.class).getStatusCode());
+ assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics", String.class).getStatusCode());
+ assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics/jvm.memory.used", String.class).getStatusCode());
+ }
+}
diff --git a/server/src/test/java/cn/keking/config/ActuatorOverrideExposureSecurityTests.java b/server/src/test/java/cn/keking/config/ActuatorOverrideExposureSecurityTests.java
new file mode 100644
index 000000000..75155ab40
--- /dev/null
+++ b/server/src/test/java/cn/keking/config/ActuatorOverrideExposureSecurityTests.java
@@ -0,0 +1,9 @@
+package cn.keking.config;
+
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class,
+ properties = "spring.config.name=test",
+ webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class ActuatorOverrideExposureSecurityTests extends ActuatorExposureSecurityTests {
+}
diff --git a/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java b/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java
new file mode 100644
index 000000000..eab8d72be
--- /dev/null
+++ b/server/src/test/java/cn/keking/service/ArchiveTraversalSecurityTests.java
@@ -0,0 +1,42 @@
+package cn.keking.service;
+
+import cn.keking.config.ConfigConstants;
+import cn.keking.model.FileAttribute;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class ArchiveTraversalSecurityTests {
+ @TempDir Path temp;
+
+ @Test void existingExtractorRejectsZipSlipBeforeWritingOutsideArchive() throws Exception {
+ String previous = ConfigConstants.getFileDir();
+ try {
+ CompressFileReader reader = new CompressFileReader(null);
+ for (String directory : List.of("first", "second")) {
+ Path root = Files.createDirectory(temp.resolve(directory));
+ ConfigConstants.setFileDirValue(root.toString());
+ Path archive = root.resolve("malicious.zip");
+ try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive))) {
+ zip.putNextEntry(new ZipEntry("../outside-marker.txt"));
+ zip.write("BENIGN-CANARY".getBytes());
+ zip.closeEntry();
+ }
+ Exception error = assertThrows(Exception.class, () -> reader
+ .unRar(archive.toString(), "", "malicious.zip", new FileAttribute()));
+ assertTrue(error.getMessage().contains("Unsafe path detected"), error.toString());
+ assertTrue(Files.isDirectory(root.resolve("malicious.zip_")));
+ assertFalse(Files.exists(root.resolve("outside-marker.txt")));
+ }
+ } finally {
+ ConfigConstants.setFileDirValue(previous);
+ }
+ }
+}
diff --git a/server/src/test/java/cn/keking/utils/FtpCommandSecurityTests.java b/server/src/test/java/cn/keking/utils/FtpCommandSecurityTests.java
new file mode 100644
index 000000000..d5b4235a2
--- /dev/null
+++ b/server/src/test/java/cn/keking/utils/FtpCommandSecurityTests.java
@@ -0,0 +1,46 @@
+package cn.keking.utils;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.io.IOException;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class FtpCommandSecurityTests {
+ @ParameterizedTest
+ @ValueSource(strings = {
+ "file.txt%0D%0ANOOP", "file.txt%0d%0aNOOP/clean.txt",
+ "file.txt%0D%0ANOOP?fullfilename=clean.txt", "file.txt%0aNOOP", "file.txt%00"
+ })
+ void rejectsDecodedControlsBeforeDownloadOrPreviewConnects(String path) {
+ String url = "ftp://127.0.0.1/" + path;
+ IOException download = assertThrows(IOException.class,
+ () -> FtpUtils.download(url, "1", "unused", "user", "pass", "UTF-8"));
+ IOException preview = assertThrows(IOException.class,
+ () -> FtpUtils.preview(url, "1", "unused", "user", "pass", "UTF-8"));
+ assertTrue(download.getMessage().contains("control characters"));
+ assertTrue(preview.getMessage().contains("control characters"));
+ }
+
+ @Test
+ void rejectsControlsInCredentialsBeforeConnecting() {
+ IOException error = assertThrows(IOException.class,
+ () -> FtpUtils.preview("ftp://127.0.0.1/file.txt", "1", "unused",
+ "user\r\nNOOP", "pass", "UTF-8"));
+ assertTrue(error.getMessage().contains("control characters"));
+ error = assertThrows(IOException.class,
+ () -> FtpUtils.download("ftp://127.0.0.1/file.txt", "1", "unused",
+ "user", "pass\nNOOP", "UTF-8"));
+ assertTrue(error.getMessage().contains("control characters"));
+ }
+
+ @Test
+ void preservesOrdinaryEncodedNamesAndDoesNotDoubleDecode() {
+ Object info = ReflectionTestUtils.invokeMethod(FtpUtils.class, "parseFtpConnectionInfo",
+ "ftp://files.example/a%20b/%E4%B8%AD%E6%96%87%250D.txt", "21", "user", "pass", "UTF-8");
+ assertEquals("/a b/中文%0D.txt", ReflectionTestUtils.getField(info, "remoteFilePath"));
+ }
+}
diff --git a/server/src/test/java/cn/keking/web/controller/ArchiveDirectorySecurityTests.java b/server/src/test/java/cn/keking/web/controller/ArchiveDirectorySecurityTests.java
new file mode 100644
index 000000000..a8c32cf8a
--- /dev/null
+++ b/server/src/test/java/cn/keking/web/controller/ArchiveDirectorySecurityTests.java
@@ -0,0 +1,84 @@
+package cn.keking.web.controller;
+
+import cn.keking.config.ConfigConstants;
+import cn.keking.model.FileAttribute;
+import cn.keking.service.FileHandlerService;
+import cn.keking.service.ZtreeNodeVo;
+import cn.keking.service.impl.CompressFilePreviewImpl;
+import cn.keking.utils.RarUtils;
+import freemarker.template.Configuration;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.ui.ExtendedModelMap;
+
+import java.io.StringWriter;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+class ArchiveDirectorySecurityTests {
+ @TempDir Path temp;
+ private String previousDir;
+ private Boolean previousCache;
+ @BeforeEach void setup() throws Exception {
+ previousDir = ConfigConstants.getFileDir();
+ previousCache = ConfigConstants.isCacheEnabled();
+ ConfigConstants.setFileDirValue(temp.toString());
+ ConfigConstants.setCacheEnabledValueValue(true);
+ Files.createDirectories(temp.resolve("archive.zip_/nested"));
+ Files.writeString(temp.resolve("archive.zip_/nested/visible.txt"), "visible");
+ Files.writeString(temp.resolve("private-document.pdf"), "secret");
+ }
+ @AfterEach void restore() {
+ ConfigConstants.setFileDirValue(previousDir);
+ ConfigConstants.setCacheEnabledValueValue(previousCache);
+ }
+
+ @Test void publicDirectoryEnumerationRouteIsAbsent() throws Exception {
+ MockMvcBuilders.standaloneSetup(new FileController()).build()
+ .perform(get("/directory").param("urls", "aHR0cDovLy8="))
+ .andExpect(status().isNotFound());
+ }
+ @Test void treeIsConfinedAndDoesNotFollowLinksOrExposeAbsoluteParents() throws Exception {
+ Files.createSymbolicLink(temp.resolve("archive.zip_/secret-link"), temp.resolve("private-document.pdf"));
+ Files.createSymbolicLink(temp.resolve("archive.zip_/loop"), temp.resolve("archive.zip_"));
+ List tree = RarUtils.getTree("archive.zip_");
+ assertEquals("", tree.get(0).pid);
+ assertEquals(1, tree.get(0).children.size());
+ assertEquals("archive.zip_/nested/visible.txt", tree.get(0).children.get(0).children.get(0).id);
+ assertThrows(SecurityException.class, () -> RarUtils.getTree(""));
+ assertThrows(SecurityException.class, () -> RarUtils.getTree("/"));
+ assertThrows(SecurityException.class, () -> RarUtils.getTree("../"));
+ }
+ @Test void cachedArchivePreviewRendersItsTreeWithoutAnEnumerationRequest() throws Exception {
+ Files.writeString(temp.resolve("archive.zip_/quote'\"",
+ "1;alert(1)", "-1", "2147483648", "999999999999999999999"})
+ void rendersOnlySafeScalarValuesThroughControllerAndPdfTemplate(String payload) throws Exception {
+ ExtendedModelMap model = preview(payload, payload);
+ assertEquals("0", model.get("page"));
+ assertEquals("false", model.get("kkagent"));
+ model.put("baseUrl", "https://preview.example/");
+ for (String name : new String[]{"watermarkXSpace", "watermarkYSpace", "watermarkAlpha",
+ "watermarkWidth", "watermarkHeight", "watermarkAngle"}) {
+ model.put(name, "0");
+ }
+ Configuration cfg = new Configuration(Configuration.VERSION_2_3_32);
+ cfg.setClassForTemplateLoading(getClass(), "/web");
+ cfg.setClassicCompatible(true);
+ StringWriter output = new StringWriter();
+ cfg.getTemplate("pdf.ftl").process(model, output);
+ String html = output.toString();
+ assertTrue(html.contains("var kkagent = 'false';"));
+ assertTrue(html.contains("#page=0"));
+ assertFalse(html.contains("alert(1)"));
+ }
+
+ @Test void preservesSupportedValues() {
+ assertEquals("12", preview("0012", "false").get("page"));
+ assertEquals("2147483647", preview("2147483647", "true").get("page"));
+ assertEquals("true", preview("1", "true").get("kkagent"));
+ }
+}
diff --git a/server/src/test/java/cn/keking/web/controller/UploadPathSecurityTests.java b/server/src/test/java/cn/keking/web/controller/UploadPathSecurityTests.java
new file mode 100644
index 000000000..71af129fb
--- /dev/null
+++ b/server/src/test/java/cn/keking/web/controller/UploadPathSecurityTests.java
@@ -0,0 +1,87 @@
+package cn.keking.web.controller;
+
+import cn.keking.config.ConfigConstants;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+class UploadPathSecurityTests {
+ @TempDir Path temp;
+ private String oldDir;
+ private Boolean oldDisabled;
+ private MockMvc mvc;
+
+ @BeforeEach void setup() throws Exception {
+ oldDir = ConfigConstants.getFileDir();
+ oldDisabled = ConfigConstants.getFileUploadDisable();
+ ConfigConstants.setFileDirValue(Files.createDirectory(temp.resolve("files")).toString());
+ ConfigConstants.setFileUploadDisableValue(false);
+ mvc = MockMvcBuilders.standaloneSetup(new FileController()).build();
+ }
+
+ @AfterEach void restore() {
+ ConfigConstants.setFileDirValue(oldDir);
+ ConfigConstants.setFileUploadDisableValue(oldDisabled);
+ }
+
+ private MockMultipartFile file() {
+ return new MockMultipartFile("file", "canary.pdf", "application/pdf", "CANARY".getBytes());
+ }
+
+ @ParameterizedTest
+ @ValueSource(strings = {"../../outside", "..\\..\\outside", "/tmp/outside", "C:\\outside",
+ "\\\\server\\share", "a/../outside", ".. /outside", "bad\0path"})
+ void refusesTraversalAtBothHttpEndpoints(String path) throws Exception {
+ mvc.perform(multipart("/fileUpload").file(file()).param("path", path))
+ .andExpect(jsonPath("$.code").value(1));
+ mvc.perform(post("/createFolder").param("path", path).param("folderName", "new"))
+ .andExpect(jsonPath("$.code").value(1));
+ assertFalse(Files.exists(temp.resolve("outside")));
+ }
+
+ @Test void preservesNestedUploadsAndRefusesOverwrite() throws Exception {
+ mvc.perform(multipart("/fileUpload").file(file()).param("path", "nested/child"))
+ .andExpect(jsonPath("$.code").value(0));
+ Path target = temp.resolve("files/demo/nested/child/canary.pdf");
+ assertEquals("CANARY", Files.readString(target));
+ mvc.perform(multipart("/fileUpload").file(file()).param("path", "nested/child"))
+ .andExpect(jsonPath("$.code").value(1));
+ mvc.perform(post("/createFolder").param("path", "nested\\child").param("folderName", "new"))
+ .andExpect(jsonPath("$.code").value(0));
+ assertTrue(Files.isDirectory(target.getParent().resolve("new")));
+ }
+
+ @Test void refusesParentSymlinksAndExistingFileSymlinks() throws Exception {
+ Path root = Files.createDirectory(temp.resolve("files/demo"));
+ Path outside = Files.createDirectory(temp.resolve("outside"));
+ Files.createSymbolicLink(root.resolve("link"), outside);
+ mvc.perform(multipart("/fileUpload").file(file()).param("path", "link/new"))
+ .andExpect(jsonPath("$.code").value(1));
+ mvc.perform(post("/createFolder").param("path", "link/new").param("folderName", "new"))
+ .andExpect(jsonPath("$.code").value(1));
+ assertFalse(Files.exists(outside.resolve("new")));
+ Files.createSymbolicLink(root.resolve("canary.pdf"), outside.resolve("missing.pdf"));
+ mvc.perform(multipart("/fileUpload").file(file()))
+ .andExpect(jsonPath("$.code").value(1));
+ assertFalse(Files.exists(outside.resolve("missing.pdf")));
+ }
+
+ @Test void uploadDisableStillBlocksBothEndpoints() throws Exception {
+ ConfigConstants.setFileUploadDisableValue(true);
+ mvc.perform(multipart("/fileUpload").file(file())).andExpect(jsonPath("$.code").value(1));
+ mvc.perform(post("/createFolder").param("folderName", "new"))
+ .andExpect(jsonPath("$.code").value(1));
+ assertFalse(Files.exists(temp.resolve("files/demo")));
+ }
+}
diff --git a/server/src/test/java/cn/keking/web/filter/PreviewSourceSecurityTests.java b/server/src/test/java/cn/keking/web/filter/PreviewSourceSecurityTests.java
new file mode 100644
index 000000000..1bc694cc5
--- /dev/null
+++ b/server/src/test/java/cn/keking/web/filter/PreviewSourceSecurityTests.java
@@ -0,0 +1,75 @@
+package cn.keking.web.filter;
+
+import cn.keking.config.ConfigConstants;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class PreviewSourceSecurityTests {
+ private String previousLocalDir;
+ @BeforeEach void setup() {
+ previousLocalDir = ConfigConstants.getLocalPreviewDir();
+ ConfigConstants.setLocalPreviewDirValue("/allowed-preview-root");
+ ConfigConstants.setTrustHostValue("files.example");
+ ConfigConstants.setNotTrustHostValue("127.0.0.1");
+ }
+ @AfterEach void restore() {
+ org.springframework.test.util.ReflectionTestUtils.setField(ConfigConstants.class, "localPreviewDir", previousLocalDir);
+ ConfigConstants.setTrustHostValue("default");
+ ConfigConstants.setNotTrustHostValue("default");
+ }
+ private String encoded(String url) {
+ return Base64.getEncoder().encodeToString(url.getBytes(StandardCharsets.UTF_8));
+ }
+ private MockHttpServletResponse filter(MockHttpServletRequest request) throws Exception {
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ AtomicBoolean reached = new AtomicBoolean();
+ new TrustHostFilter().doFilter(request, response, (req, res) -> reached.set(true));
+ assertEquals(response.getStatus() == 200, reached.get());
+ return response;
+ }
+ @ParameterizedTest
+ @ValueSource(strings = {"url", "currentUrl", "urls"})
+ void allowedDecoysCannotHideBlockedFetchTarget(String decoy) throws Exception {
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/getCorsFile");
+ request.setParameter(decoy, encoded("https://files.example/allowed.pdf"));
+ request.setParameter("urlPath", encoded("http://127.0.0.1/private.pdf"));
+ assertEquals(403, filter(request).getStatus());
+ }
+ @Test void validatesEveryImageAndEveryRepeatedParameter() throws Exception {
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/picturesPreview");
+ request.setParameter("urls", encoded("https://files.example/a.jpg|http://127.0.0.1/b.jpg"));
+ assertEquals(403, filter(request).getStatus());
+ request = new MockHttpServletRequest("GET", "/getCorsFile");
+ request.setParameter("urlPath", encoded("https://files.example/a.pdf"), encoded("http://127.0.0.1/a.pdf"));
+ assertEquals(403, filter(request).getStatus());
+ }
+ @Test void preservesAllowedRequestsAndRejectsMissingOrMalformedSources() throws Exception {
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/getCorsFile");
+ assertEquals(403, filter(request).getStatus());
+ request.setParameter("urlPath", "%%%bad");
+ assertEquals(403, filter(request).getStatus());
+ request.setParameter("urlPath", encoded("https://files.example/a.pdf"));
+ assertEquals(200, filter(request).getStatus());
+ request.setParameter("url", encoded("https://files.example/b.pdf"));
+ assertEquals(200, filter(request).getStatus());
+ }
+ @Test void directoryFilterAlsoRejectsHiddenFileTargets() throws Exception {
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/getCorsFile");
+ request.setParameter("url", encoded("https://files.example/a.pdf"));
+ request.setParameter("urlPath", encoded("file:///outside-preview-root/private.pdf"));
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ new TrustDirFilter().doFilter(request, response, (req, res) -> fail("Unsafe URL reached controller"));
+ assertEquals(403, response.getStatus());
+ }
+}