Java代码审计：文件上传

public String singleFileUpload(@RequestParam("file") MultipartFile file, RedirectAttributes redirectAttributes) {    try {        byte[] bytes = file.getBytes();        Path dir = Paths.get(UPLOADED_FOLDER);        Path path = Paths.get(UPLOADED_FOLDER + file.getOriginalFilename());
        Files.write(path, bytes);        redirectAttributes.addFlashAttribute("message","上传文件成功：" + path + "");    } catch (Exception e) {         return e.toString();    }    return "redirect:upload_status";}

public String singleFileUploadSafe(@RequestParam("file") MultipartFile file,                                   RedirectAttributes redirectAttributes) {    try {        byte[] bytes = file.getBytes();        String fileName = file.getOriginalFilename();        Path dir = Paths.get(UPLOADED_FOLDER);        Path path = Paths.get(UPLOADED_FOLDER + file.getOriginalFilename());
        // 获取文件后缀名        String Suffix = fileName.substring(fileName.lastIndexOf("."));
        String[] SuffixSafe = {".jpg", ".png", ".jpeg", ".gif", ".bmp", ".ico"};        boolean flag = false;
        for (String s : SuffixSafe) {            if (Suffix.toLowerCase().equals(s)) {                flag = true;                break;            }        }
        if (!flag) {            return "只允许上传图片，[.jpg, .png, .jpeg, .gif, .bmp, .ico]";        }

https://github.com/j3ers3/Hello-Java-Sec