CVE-2022-32065: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-13T15:15Z
Repository: https://github.com/yangzongzhuan/RuoYi
Language: Java
Files changed: ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java, ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java
Commit date: 2022-05-22 12:44:40 +0800
Commit message: 用户头像上传格式限制

Diff: diff --git a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
index 60e9dd9b..9f4db070 100644
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
@@ -20,10 +20,11 @@ import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.common.utils.DateUtils;
 import com.ruoyi.common.utils.ShiroUtils;
 import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.common.utils.file.FileUploadUtils;
+import com.ruoyi.common.utils.file.MimeTypeUtils;
 import com.ruoyi.framework.shiro.service.SysPasswordService;
 import com.ruoyi.system.service.ISysUserService;
 
 /**
  * 个人信息 业务处理
@@ -166,11 +167,11 @@ public class SysProfileController extends BaseController
         SysUser currentUser = getSysUser();
         try
         {
             if (!file.isEmpty())
             {
-                String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file);
+                String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file, MimeTypeUtils.IMAGE_EXTENSION);
                 currentUser.setAvatar(avatar);
                 if (userService.updateUserInfo(currentUser) > 0)
                 {
                     setSysUser(userService.selectUserById(currentUser.getUserId()));
                     return success();
diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java b/ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java
index 8954bbb1..c144f147 100644
--- a/ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java
+++ b/ruoyi-common/src/main/java/com/ruoyi/common/exception/file/InvalidExtensionException.java
@@ -16,11 +16,11 @@ public class InvalidExtensionException extends FileUploadException
     private String extension;
     private String filename;
 
     public InvalidExtensionException(String[] allowedExtension, String extension, String filename)
     {
-        super("filename : [" + filename + "], extension : [" + extension + "], allowed extension : [" + Arrays.toString(allowedExtension) + "]");
+        super("文件[" + filename + "]后缀[" + extension + "]不正确，请上传 [" + Arrays.toString(allowedExtension) + "]格式文件");
         this.allowedExtension = allowedExtension;
         this.extension = extension;
         this.filename = filename;
     }
 

Vulnerable code:                 String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file);
        super("filename : [" + filename + "], extension : [" + extension + "], allowed extension : [" + Arrays.toString(allowedExtension) + "]");
Fixed code: import com.ruoyi.common.utils.file.MimeTypeUtils;
                String avatar = FileUploadUtils.upload(RuoYiConfig.getAvatarPath(), file, MimeTypeUtils.IMAGE_EXTENSION);
        super("文件[" + filename + "]后缀[" + extension + "]不正确，请上传 [" + Arrays.toString(allowedExtension) + "]格式文件");