diff --git a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java index 2d22e29..792c92b 100644 --- a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java +++ b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java @@ -118,28 +118,22 @@ public List findAllModelo() { @Override public String lerArquivo(String nome) { StringBuilder strOut = new StringBuilder(); - try{ - String[] command; - command = new String[]{"sh", "-c", "cat " + nome}; - //command = new String[]{"cmd.exe", "/c", "type " + nome}; - - Runtime rt = Runtime.getRuntime(); - Process proc = rt.exec(command); - int result = proc.waitFor(); - if(result != 0){ - System.out.println("process error"); - } - InputStream in = (result == 0) ? proc.getInputStream():proc.getErrorStream(); - int c; - while((c=in.read())!= -1){ - strOut.append((char) c); + try { + // Validate and sanitize the file path to prevent command injection + Path filePath = Paths.get(nome).normalize(); + + // Ensure the path does not contain shell metacharacters or path traversal + String sanitizedPath = filePath.toString(); + if (!sanitizedPath.matches("[a-zA-Z0-9_.\\-/\\\\: ]+")) { + throw new SecurityException("Invalid file path: contains disallowed characters."); } - return strOut.toString(); - }catch(Exception e){ - return e.toString(); - } + // Use Java NIO to read the file instead of executing a shell command + byte[] fileBytes = Files.readAllBytes(filePath); + return new String(fileBytes); + } catch (Exception e) { + return e.toString(); + } } } -