. Net File Upload Vulnerability code example and repair solution

Some of the Code obtained during the test is lost, and there is only one repair solution. Let's take a look. Something is simple. String str = filename. substring (filename. lastIndexOf (". ") + 1, 3 ); if (str = "png" | str = "gif" | str = "jpg" | str = "jpeg" | str = "PNG" | str = "GIF" | str = "JPG" | str = "JPEG ") {string sfd = savePath; string sf = filename. substring (0, filename. lastIndexOf (". ") +" _ "+ DateTime. now. toString ("yyMMddhhmmss") + ". "+ str; savePath + = filename + sf; this. hidurl. value = "SecFile/ "+ Sf; // the token is OK. Fix code: [code = "csharp"] string sf = DateTime. now. toString ("yyMMddhhmmss") + ". "+ str; [/code] ----- <font face =" "> <code id =" code1 "> fileurl = context. request ["folder"]; </code> </font> get the folder address from the Request header. Iis6 truncation or semicolon ------ <font face = ""> <code id = "code2"> protected void SaveImg (HttpPostedFile file, string type, string roomid, string roomname, string btntype) {# region saves the image string imgname = Path. getFileName (file. fileName ). toLower (); if (imgname. length = 0) {if (btntype = "edit") {Response. write ("{\" result \ ": \" "+ AddMode (" ", roomid, roomname) +" \ "}"); return;} Response. write ("{\" result \ ": \"-2 \ "}"); return;} imgname = imgname. substring (0, imgname. length-4); string PicType = Path. getExtension (file. fileName ). toLower (); // get the image extension // if (PicType = ". jpg "| PicType = ". gif "| PicType = ". jpeg "| PicType = ". bmp ") {// string phsavename = string. empty; // client string phserver = Server. mapPath ("roomlogpic" + "/") + "/roomImage/"; string saveserver =" http://www.cunlide.com/admin/roomlogpic/roomImage/ "; If (Directory. exists (phserver) = false) // create a file folder {Directory. createDirectory (phserver);} try {int result = 0; switch (type) {case "delete": // delete temporary phsavename = DateTime. now. year + "" + DateTime. now. month + "" + DateTime. now. day + PicType; System. IO. file. delete (phserver + Path. getFileName (file. fileName ). toLower (); break; case "save": // upload phsavename = imgname + "_" + DateTime. now. year + "" + DateTime. now. month + "" + DateTime. now. day + PicType; // No filtering. The following is the patch code. // phsavename = DateTime. now. year + "" + DateTime. now. month + "" + DateTime. now. day + PicType; file. saveAs (phserver + phsavename); System. IO. file. delete (phserver + Path. getFileName (file. fileName ). toLower (); result = AddMode (saveserver + phsavename, roomid, roomname); break; case "temp": // temporarily upload phsavename = DateTime. now. year + "" + DateTime. now. month + "" + DateTime. now. day + PicType; file. saveAs (phserver + phsavename); break; default: break;} Response. write ("{\" result \ ": \" "+ result +" \ "}"); // upload result return;} catch (System. nullReferenceException) {Response. write ("{\" result \ ": \"-1 \ "}"); // return;} # endregion //} // else {Response. write ("file type: jpg gif jpeg bmp only! ") ;}}</Code> </font>