深入剖析任意文件下载漏洞：原理、利用与防御策略

 <?php
   $file = $_GET['filename'];
   header('Content-Type: application/octet-stream');
   header("Content-Disposition: attachment; filename=\"$file\"");
   readfile($file);
   ?>

// 不安全的下载功能示例
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.*;

public class InsecureFileDownloadServlet extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // 直接从请求参数获取文件名，没有进行任何验证
        String requestedFileName = request.getParameter("filename");

        // 构建完整的文件路径，假设基于应用的根目录
        String filePath = getServletContext().getRealPath("/") + requestedFileName;

        // 尝试打开文件并发送给客户端
        File fileToDownload = new File(filePath);
        if (fileToDownload.exists()) {
            // 设置响应内容类型和名称
            response.setContentType(getServletContext().getMimeType(requestedFileName));
            response.setHeader("Content-Disposition", "attachment; filename=\"" + requestedFileName + "\"");

            // 直接读取文件并输出到响应流，没有做任何安全性检查
            InputStream in = new FileInputStream(fileToDownload);
            OutputStream out = response.getOutputStream();
            byte[] buffer = new byte[4096];
            int length;
            while ((length = in.read(buffer)) > 0) {
                out.write(buffer, 0, length);
            }
            in.close();
            out.close();
        } else {
            response.sendError(HttpServletResponse.SC_NOT_FOUND, "File not found.");
        }
    }
}

@GetMapping("/download")
public ResponseEntity<Resource> downloadFile(@RequestParam String fileName) {
    Path filePath = Paths.get("/var/app/uploads/", fileName);
    // ...省略其他未做路径验证的逻辑...
    FileSystemResource file = new FileSystemResource(filePath.toFile());
    return ResponseEntity.ok()
            .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + fileName + "\"")
            .body(file);
}

   from flask import send_from_directory, abort
   from werkzeug.utils import secure_filename

   @app.route('/download/<path:filename>')
   def download(filename):
       safe_filename = secure_filename(filename)
       upload_folder = '/path/to/safe/downloads/'
       full_path = os.path.join(upload_folder, safe_filename)

       if not os.path.isfile(full_path):
           abort(404)

       return send_from_directory(upload_folder, safe_filename, as_attachment=True)