fix: 目录遍历漏洞

proxy-server/src/main/java/org/fengfei/lanproxy/server/config/web/HttpRequestHandler.java

@@ -4,7 +4,7 @@
 import java.io.RandomAccessFile;
 import java.net.URI;
 import java.nio.charset.Charset;
-
+import java.util.Set;
 import org.fengfei.lanproxy.common.JsonUtil;
 
 import io.netty.buffer.Unpooled;
@@ -34,6 +34,8 @@ public class HttpRequestHandler extends SimpleChannelInboundHandler<FullHttpRequ
 
     private static final String SERVER_VS = "LPS-0.1";
 
+    private Set<String> urlSet = URLHelper.generateURLMap(null,PAGE_FOLDER,PAGE_FOLDER);
+
     @Override
     protected void channelRead0(ChannelHandlerContext ctx, FullHttpRequest request) throws Exception {
 
@@ -77,6 +79,8 @@ private void outputPages(ChannelHandlerContext ctx, FullHttpRequest request) thr
         URI uri = new URI(request.getUri());
         String uriPath = uri.getPath();
         uriPath = uriPath.equals("/") ? "/index.html" : uriPath;
+        urlSet.add("/lanproxy-config/");
+
         String path = PAGE_FOLDER + uriPath;
         File rfile = new File(path);
         if (rfile.isDirectory()) {
@@ -93,6 +97,11 @@ private void outputPages(ChannelHandlerContext ctx, FullHttpRequest request) thr
         if (HttpHeaders.is100ContinueExpected(request)) {
             send100Continue(ctx);
         }
+        if(!urlSet.contains(uriPath)){
+            status = HttpResponseStatus.NON_AUTHORITATIVE_INFORMATION;
+            outputContent(ctx, request, status.code(), status.toString(), "text/html");
+            return;
+        }
 
         String mimeType = MimeType.getMimeType(MimeType.parseSuffix(path));
         long length = 0;

proxy-server/src/main/java/org/fengfei/lanproxy/server/config/web/URLHelper.java

@@ -0,0 +1,42 @@
+package org.fengfei.lanproxy.server.config.web;
+
+import java.io.File;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ *  * @author necho.duan
+ *   * @title: URLHandler
+ *    * @projectName lanproxy
+ *     * @description:
+ *      * @date 2021/1/11 16:29
+ *       */
+public class URLHelper {
+
+    public static Set<String>  generateURLMap(Set<String> s, String rfloader, String folder){
+          if(s==null){
+              s=new HashSet<String>();
+          }
+          File file  = new File(folder);
+          File[] t = file.listFiles();
+          for(File sfile: t)
+          {
+              if(sfile.isFile()){
+                s.add(sfile.getAbsolutePath().substring(sfile.getAbsolutePath().indexOf(rfloader)+rfloader.length()+1).replaceAll("\\\\","/"));
+              }else{
+                generateURLMap(s,rfloader,sfile.getAbsolutePath());
+              }
+          }
+          return s;
+    }
+
+
+    public static void main(String[] args) {
+        Set set =  generateURLMap(null,"D:\\github_code\\lanproxy\\proxy-server\\webpages","D:\\github_code\\lanproxy\\proxy-server\\webpages");
+        System.out.println(Arrays.toString(set.toArray()));
+
+    }
+
+
+}