<%@ page language="java" session="true" contentType="text/html; charset=euc-kr" %>
<%@ page import="java.text.SimpleDateFormat,java.util.Date" %>
<%@ page import="java.util.*,java.io.*,java.net.*"%>
<html>
<head>
<script type="text/javascript">
function callDown(){
var file_name = document.getElementById("file_name").value;
var targetURL = "/logDown.jsp?file_name="+file_name;
location.href = targetURL;
}
</script>
<meta http-equiv="Content-Type" content="text/html; charset=EUC-KR">
<title></title>
</head>
<body>
파일 경로 및 이름 (윈도일 경우: C:/aa)<input id="file_name" type="text" size="50" value="/data/test.txt">
<button onclick="callDown();">Download</button>
<table>
<tr><td class="bg">Result</td></tr>
<%
String line = "";
String file_name = (String)request.getParameter("file_name");
//취약점
if(file_name != null){
file_name = file_name.replace("../", "");
file_name = file_name.replace("./", "");
file_name = file_name.replace(".\\", "");
file_name = file_name.replace("..\\", "");
file_name = file_name.replace("%", "");
file_name = file_name.replace(";", "");
}
System.out.println("file_name="+file_name);
if(file_name == null || "".equals(file_name)){
line = "file info is empty";
}else{
System.out.println("========== request.getParameter file_name : " + file_name);
System.out.println("========== file_name : " + file_name);
File f = new File(file_name);
if(f.exists()){
int filesize = (int)f.length();
byte buff[] = new byte[1024*20];
int bytesRead;
try {
response.setContentType("application/x-msdownload");
response.setHeader("Content-Disposition","attachment; filename="+ file_name);
FileInputStream fin = new java.io.FileInputStream(f);
BufferedInputStream bis = new BufferedInputStream(fin);
ServletOutputStream fout = response.getOutputStream();
BufferedOutputStream bos = new BufferedOutputStream(fout);
while((bytesRead = bis.read(buff)) != -1) {
bos.write(buff, 0, bytesRead);
}
bos.flush();
fin.close();
fout.close();
bis.close();
bos.close();
line = "file download success";
} catch( IOException e){
response.setContentType("text/html");
out.println("Error : "+e.getMessage());
line = e.getMessage();
}
} else {
response.setContentType("text/html");
line = "file is not exist";
}
}
%>
</table>
</body>
</html>
