Java代码审计：路径穿越

GetMapping("/download")public String download(String filename, HttpServletRequest request, HttpServletResponse response) {    String filePath = System.getProperty("user.dir") + "/logs/" + filename;    try {        File file = new File(filePath);        InputStream is = new BufferedInputStream(new FileInputStream(file));        byte[] buffer = new byte[is.available()];        fis.read(buffer);        fis.close();        response.reset();        response.addHeader("Content-Disposition", "attachment;filename=" + filename);        response.addHeader("Content-Length", "" + file.length());        OutputStream toClient = new BufferedOutputStream(response.getOutputStream());        response.setContentType("application/octet-stream");        toClient.write(buffer);        toClient.flush();        toClient.close();        return "下载文件成功：" + filePath;

public static boolean check_traversal(String content) {    return content.contains("..") || content.contains("/");}

https://github.com/j3ers3/Hello-Java-Sec