WooYun.org

...
@RequestMapping("/member/o_upload_image.jspx")
	public String execute(
			String filename,
			Integer uploadNum,
			Boolean mark,
			@RequestParam(value = "uploadFile", required = false) MultipartFile file,
			HttpServletRequest request, ModelMap model) {
		WebCoreErrors errors = validate(filename, file, request); //函数validate检查后缀以及文件头
		CmsSite site = CmsUtils.getSite(request);
		CmsUser user = CmsUtils.getUser(request);
		FrontUtils.frontData(request, model, site);
		MemberConfig mcfg = site.getConfig().getMemberConfig();
		if (!mcfg.isMemberOn()) {
			return FrontUtils.showMessage(request, model, "member.memberClose");
		}
		if (user == null) {
			return FrontUtils.showLogin(request, model, site);
		}
		if (errors.hasErrors()) {
			model.addAttribute(ERROR, errors.getErrors().get(0));
			return FrontUtils.getTplPath(request, site.getSolutionPath(),
					TPLDIR_MEMBER, RESULT_PAGE);
		}
		MarkConfig conf = site.getConfig().getMarkConfig();
		if (mark == null) {
			mark = conf.getOn();
		}
		String origName = file.getOriginalFilename();
		String ext = FilenameUtils.getExtension(origName).toLowerCase(
				Locale.ENGLISH);
		try {
			String fileUrl;
			if (site.getConfig().getUploadToDb()) {
				....好像是文件存进数据库，这段跳过
				}
			} else if (site.getUploadFtp() != null) {
                               .....ftp上传相关，跳过
				}
			} else {
				String ctx = request.getContextPath();
				if (!StringUtils.isBlank(filename)) {  //filename为表单传进，可控 
					filename = filename.substring(ctx.length());
					if (mark) {  //mark 为表单传进，可控
						File tempFile = mark(file, conf);
						fileUrl = fileRepository.storeByFilename(filename,tempFile);  
                                              //调用storeByFilename存储文件，filename可控，第一想到的就是00截断了
						tempFile.delete();
					} else { //mark 不用赋值也可以，都调用了fileRepository.storeByFilename
						fileUrl = fileRepository
								.storeByFilename(filename, file);
					}
				} else {  //如果filename为空，则调用fileRepository.storeByExt ，后缀保留，文件重命名
					if (mark) {
						File tempFile = mark(file, conf);
						fileUrl = fileRepository.storeByExt(USER_IMG_PATH, ext, tempFile);
						tempFile.delete();
					} else {
						fileUrl = fileRepository.storeByExt(USER_IMG_PATH, ext, file);
					}
					// 加上部署路径
					fileUrl = ctx + fileUrl;
				}
			}
			model.addAttribute("uploadPath", fileUrl);
			model.addAttribute("uploadNum", uploadNum);
		} catch (IllegalStateException e) {
			model.addAttribute(ERROR, e.getMessage());
			log.error("upload file error!", e);
		} catch (IOException e) {
			model.addAttribute(ERROR, e.getMessage());
			log.error("upload file error!", e);
		} catch (Exception e) {
			model.addAttribute(ERROR, e.getMessage());
			log.error("upload file error!", e);
		}
		return FrontUtils.getTplPath(request, site.getSolutionPath(),
				TPLDIR_MEMBER, RESULT_PAGE);
	}
...

public static int indexOfExtension(String filename)
  {
    if (filename == null) {
      return -1;
    }
    int extensionPos = filename.lastIndexOf('.'); //可以看出获取后缀的方式是截取最后一个点号的部分，那么如果filename为1.jsp%00.jpg ，就能bypass后缀检查了.
    int lastSeparator = indexOfLastSeparator(filename);
    return lastSeparator > extensionPos ? -1 : extensionPos;
  }