su

解压文件时未对 ../ 进行校验  Demo： `packagecom.sp.test; importorg.apache.commons.fileupload.FileItem; importorg.apache.commons.fileupload.FileItemFactory; importorg.apache.commons.fileupload.disk.DiskFileItemFactory; importorg.apache.commons.io.FileUtils; importorg.springframework.web.multipart.MultipartFile; import org.springframework.web.multipart.commons.CommonsMultipartFile; importorg.xml.sax.SAXException; importjava.io.*; importjava.text.SimpleDateFormat; importjava.util.Date; importjava.util.Enumeration; importjava.util.zip.ZipEntry; importjava.util.zip.ZipFile; publicclassDemo{ publicstaticvoidmain(String[]args){ MultipartFilefile=fileToMultipartFile(new File("D:\\project\\os\\ne1111w.zip")); uploadPackage(file); } publicstaticUploadPackageResultDtouploadPackage(MultipartFile pluginPackageFile){ //1.savepackagefiletolocal StringtmpFileName=new...