JAVA文件上传漏洞防御

@WebServlet("/uploads")public class UploadFile extends HttpServlet{    @Override    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {        doGet(req, resp);    }
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {        req.setCharacterEncoding("utf-8");        if(ServletFileUpload.isMultipartContent(req)){                 FileItemFactory factory = new DiskFileItemFactory();                ServletFileUpload upload = new ServletFileUpload(factory);                try {                    List<FileItem> list = upload.parseRequest(req);
                    for(FileItem fileItem:list){                        if(!fileItem.isFormField()){                            int i = fileItem.getName().lastIndexOf('.');                            if(i>0){                                String fileType = fileItem.getName().substring(i+1);                                System.out.println("上传的类型为："+fileType);                                if(fileType.equals("png")){                                    System.out.println("上传成功！");                                    System.out.println("上传的文件名："+fileItem.getName());                                    fileItem.write(new File("web根路径"+fileItem.getName()));                                }else{                                    System.out.println("非法上传，文件后缀为"+fileType);                                }                            }
                        }
                    }                } catch (Exception e) {                    e.printStackTrace();                }            }
    }
}

<servlet>    <servlet-name>tomcatpooljsp</servlet-name>    <jsp-file>/test.jsp</jsp-file>  </servlet>  <servlet-mapping>    <servlet-name>tomcatpooljsp</servlet-name>    <url-pattern>/test.png</url-pattern>  </servlet-mapping>

// 获得文件头部字符串    public static String bytesToHexString(byte[] src) {        StringBuilder stringBuilder = new StringBuilder();        if (src == null || src.length <= 0) {            return null;        }        for (int i = 0; i < src.length; i++) {            int v = src[i] & 0xFF;            String hv = Integer.toHexString(v);            if (hv.length() < 2) {                stringBuilder.append(0);            }            stringBuilder.append(hv);        }        return stringBuilder.toString();    }        FILE_TYPE_MAP.put("jpg", "FFD8FF"); //JPEG              FILE_TYPE_MAP.put("png", "89504E47"); //PNG              FILE_TYPE_MAP.put("gif", "47494638"); //GIF