package net.radar.util;

import java.util.regex.Pattern;

public class PreventTraversalUtil {

    private static Pattern FilePattern = Pattern.compile("[\\\\/:*?\"<>|]");  
 
    /**
     * 路徑遍歷 漏洞修復(fù)
     * @param str
     * @return
     */
    protected static String filenameFilter(String str) {  
        return str==null?null:FilePattern.matcher(str).replaceAll("");  

    }
}

調(diào)用

    /**
     * 根據(jù)PageTemplateConfig對(duì)象讀取模板文件內(nèi)容
     * 
     * @return 模板文件內(nèi)容
     */
    public static String readTemplateFileContent(PageTemplateConfig pageTemplateConfig) {
        String filenameFilter = PreventTraversalUtil.filenameFilter(CommonUtil.getWebRootPath() + pageTemplateConfig.getTemplatePath());
        File templateFile = new File(filenameFilter);
//      File templateFile = new File(CommonUtil.getWebRootPath() + pageTemplateConfig.getTemplatePath());
        String templateFileContent = null;
        try {
            templateFileContent = FileUtils.readFileToString(templateFile, "UTF-8");
        } catch (IOException e) {
            e.printStackTrace();
        }
        return templateFileContent;
    }