File transmission control method, section interceptor and electronic equipment

Abstract

The invention discloses a file transmission control method, a section interceptor and electronic equipment. The method comprises the steps that it is detected that a transmission method carrying a target annotation is called, the transmission method is intercepted, and the transmission method is used for achieving the file transmission function of a target interface; determining a target file type indicating that the transmission method is allowed to be executed in the target annotation and a current file type of a current transmission file of the transmission method; and under the condition that the target file type is not matched with the current file type, determining that the current transmission file is an abnormal file. According to the method and the device, the technical problem of large code maintenance limitation caused by high coupling degree of verification logic and uploading service logic of file uploading in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the technical field of file transmission, and in particular to a file transmission control method, a slice interceptor and an electronic device. Background Art

[0002] In Java Web applications, there is often a need to upload files, especially when processing batch data. However, ensuring security is a critical link, especially for those file types that may contain malicious content, such as HTML, JS, SQL, etc. These files may become a means for third parties to attack the application system, so there is a need to intercept and process these file types.

[0003] In the related art, the file type is verified in the file upload interface. However, as the business develops, the system complexity increases, and the number of file upload interfaces gradually increases, this method of coupling the verification logic with the business logic increases the amount of code and the difficulty of system maintenance, while also reducing the readability and scalability of the code. Once the file verification logic is changed, it will take a lot of time to modify the code, resulting in great limitations on code maintenance.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a file transfer control method, a slice interceptor and an electronic device to at least solve the technical problem in the related art that the verification logic and the upload business logic of file upload are highly coupled, resulting in great limitations on code maintenance.

[0006] According to one aspect of an embodiment of the present application, a file transfer control method is provided, comprising: detecting that a transfer method carrying a target annotation is called, intercepting the transfer method, wherein the transfer method is a method for implementing a file transfer function of a target interface; determining a target file type indicated in the target annotation that allows execution of the transfer method, and a current file type of a current transfer file of the transfer method; and, in a case where the target file type does not match the current file type, determining that the current transfer file is an abnormal file.

[0007] Optionally, the method also includes: when the target file type is not configured in the target annotation, querying the global rule configuration to determine the global file type, wherein the global rule configuration is a rule configuration shared by multiple interfaces, and the global file type is a file type allowed to be transmitted by the multiple interfaces; when the global file type does not match the current file type, determining that the currently transmitted file is an abnormal file.

[0008] Optionally, after determining that the currently transmitted file is an abnormal file, the method further includes: sending the currently transmitted file to a global abnormality handler; and sending abnormal file prompt information to the account that uploaded the currently transmitted file.

[0009] Optionally, the method further includes: determining a plurality of candidate extensions of the target file type; and determining that the target file type does not match the current file type when the current file type of the current file type does not match any of the plurality of candidate extensions.

[0010] Optionally, before detecting that a transmission method carrying a target annotation is called and intercepting the transmission method, the method further includes: in the presence of multiple interfaces with different execution functions, where the multiple interfaces respectively define candidate methods corresponding to the corresponding execution functions, based on predetermined file transfer requirements, determining the transmission method that needs to be intercepted from the candidate methods corresponding to the multiple interfaces; and based on the transmission method, determining the tangent point of the aspect interceptor for executing the interception behavior.

[0011] According to another aspect of an embodiment of the present application, a file transfer control method is provided, wherein a configuration component uses a target annotation to annotate a transmission method of a target interface for implementing a file transfer function; an aspect interceptor detects that the transmission method carrying the target annotation is called, and intercepts the transmission method; determines the target file type indicated in the target annotation that allows the transmission method to be executed, and the current file type of the current transmission file of the transmission method; and when the target file type does not match the current file type, determines that the current transmission file is an abnormal file.

[0012] Optionally, the configuration component uses target annotations to annotate the transmission method defined by the target interface to implement the file transfer function, including: the configuration component determines the update annotation based on the configuration update instruction; the configuration component uses the update annotation to update the annotation of the transmission method of the target interface.

[0013] Optionally, the configuration component determines an update annotation based on the configuration update instruction, including: the configuration component determines a security policy corresponding to the predetermined application environment based on a list of file types in the predetermined application environment, wherein the file type list records file types in the predetermined application environment whose risk levels are lower than a predetermined risk threshold; when there is an update process for the security policy, the update annotation is determined based on the configuration update instruction.

[0014] According to another aspect of an embodiment of the present application, a slice interceptor is provided, which is applied to any one of the file transfer control methods described above.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the file transfer control methods described.

[0016] In the embodiment of the present application, the aspect and annotation configuration method is adopted, and the transmission method is intercepted by detecting that the transmission method carrying the target annotation is called, wherein the transmission method is a method for implementing the file transfer function of the target interface; the target file type indicated in the target annotation to allow the execution of the transmission method, and the current file type of the current transmission file of the transmission method are determined; when the target file type does not match the current file type, the current transmission file is determined to be an abnormal file. The purpose of decoupling the verification logic of file upload and the upload business logic is achieved, and the technical effect of reducing the coupling degree between the verification logic and the upload business logic and improving the flexibility of code maintenance is achieved, thereby solving the technical problem that the verification logic of file upload and the upload business logic in the related technology are highly coupled, resulting in large limitations on code maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a first flow chart of an optional file transfer control method provided according to an embodiment of the present application;

[0019] Figure 2 is a second flow chart of an optional file transfer control method provided according to an embodiment of the present application;

[0020] Figure 3 is a first schematic diagram of an optional file transfer control method provided according to an embodiment of the present application;

[0021] Figure 4 is a second schematic diagram of an optional file transfer control method provided according to an embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of an optional file transfer control device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0026] Java Web applications are applications developed using the Java language and run on Web (network) servers. Such applications can process HTTP (Hypertext Transfer Protocol) requests, generate dynamic Web content in HTML, XML, JSON or other formats, and access them through browsers or other HTTP clients. You can use various libraries and components in the Java ecosystem to quickly and efficiently build feature-rich, stable Web applications.

[0027] Aspect-Oriented Programming (AOP) is a software development technique that aims to improve the modularity and maintainability of code by separating cross-cutting concerns from the main business logic.

[0028] The concepts of aspect and join point come from aspect-oriented programming. Aspect is one of the core concepts of AOP, representing the encapsulation of common concerns that cross-cut multiple modules or components in an application. A join point refers to a specific point in the execution of a program, which can be a method call, field access, etc. In AOP, a join point is a location where an aspect can be "inserted" or "hooked" to determine which specific operations to apply the aspect to. In Java Web applications, AOP technology can achieve unified management of cross-cutting concerns such as security control, logging, and transaction management by executing specific behaviors (advice) at predefined join points.

[0029] Unified Exception Handling is a common practice in software development that aims to improve system robustness and user experience by centrally processing and managing exceptions that occur in applications.

[0030] Java Annotations is a metadata mechanism provided by the Java language, which is used to add metadata information to the source code and can be parsed and processed at compile time, runtime or deployment time. The annotation itself does not affect the running logic of the program, but can provide additional information or instructions to the compiler or runtime environment.

[0031] Java reflection technology is a runtime mechanism that allows programs to dynamically obtain information about classes, interfaces, methods, and fields during execution, and to create and manipulate objects without having to determine the type at compile time. Through reflection, Java programs can "reflect" themselves, parse the structure of classes, call arbitrary methods, access and modify private members, and achieve the dynamic and flexible nature of the code.

[0032] According to an embodiment of the present application, a method embodiment of file transfer control is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 1 is a first flow chart of a file transfer control method according to an embodiment of the present application, such as Figure 1 As shown, the execution subject may be a facet interceptor (also referred to as facet for short), and the method includes the following steps:

[0034] Step S102, detecting that a transmission method carrying a target annotation is called, and intercepting the transmission method, wherein the transmission method is a method for implementing a file transmission function of a target interface;

[0035] It can be understood that the aspect can dynamically detect that a specific transfer method is called, which is used to implement the file upload function and is marked by a specific target annotation (such as @FileTypeCheck). Based on the AOP principle, the aspect will intercept the transfer method call before it is completed.

[0036] In an optional embodiment, before detecting that a transmission method carrying a target annotation is called and intercepting the transmission method, the method also includes: in the presence of multiple interfaces with different execution functions, and the multiple interfaces respectively define candidate methods corresponding to the execution functions, based on predetermined file transfer requirements, determining the transmission method that needs to be intercepted from the candidate methods corresponding to the multiple interfaces; based on the transmission method, determining the tangent point of the aspect interceptor for executing the interception behavior.

[0037] It can be understood that there are multiple interfaces, each of which defines different execution functions, including candidate methods for file transfer. Each candidate method may have different business logic, and there are transmission methods that need to perform unified file type verification among multiple candidate methods. According to the file transfer requirements (such as upload, download, preview, etc.) predetermined by the system or user, the method that needs to perform file type verification is identified from the candidate methods of these multiple interfaces as the above-mentioned transmission method. After identifying the transmission method that needs to be intercepted, a cut point is defined based on the transmission method, that is, interception and file type verification are performed at a specific stage in the life cycle of the transmission method call (such as before call, after call, surrounding call, etc.). The definition of the cut point is a key step in the aspect technology, which determines when the aspect logic is inserted into the target method. Once the cut point is determined, the aspect interceptor will be responsible for performing interception behavior at these cut points, that is, checking the file type before the transmission method is called to ensure that the file meets the security upload standard. If the file type does not meet the rules, the aspect will prevent further execution of the method, thereby protecting the system from potential malicious file upload attacks.

[0038] Through the above processing, the cut-off point definition of the aspect interceptor is automatically executed, avoiding unnecessary impact on other methods that do not involve file transfer, enhancing interception flexibility, and facilitating maintenance and expansion. Especially when there are many system interfaces and complex logic, the security verification logic of file types can be more accurately controlled and managed.

[0039] Step S104, determining the target file type indicated in the target annotation as allowing the execution of the transmission method, and the current file type of the current transmission file of the transmission method;

[0040] It can be understood that after the transfer method is intercepted, the aspect can analyze the file types allowed to be uploaded defined in the target annotation. Get the current file type of the file actually uploaded when the transfer method is currently called.

[0041] Optionally, the method parameters can be parsed through reflection technology to obtain the file extension or MIME (Multipurpose Internet Mail Extensions) type and other information to determine the current file type. MIME is used to describe the attachment type in an email, but was later widely used in the HTTP protocol to indicate the format type of a Web page or other data. It is an important type identification method in Internet data transmission. In the aspect logic of AOP, the object of the intercepted method can be obtained through reflection technology, which includes metadata information such as the method name, parameter type, and return type. From the parsed parameters, the file type can be determined in a variety of ways: if the parameter is a file path, the file type can be determined by analyzing the extension part of the file name, for example, ".jpg" represents a JPEG image, ".pdf" represents a PDF document, etc. If the MultipartFile type is used, its API can be directly called to obtain the MIME type of the file. The MIME type is a standard used to describe the format and type of a file, such as "text / html" represents an HTML document, "application / pdf" represents a PDF file, etc. The application of reflection technology enables the code to dynamically process method parameters at runtime, while the acquisition of MIME types provides more accurate file format identification capabilities, which is crucial for verifying the security and compliance of uploaded file types.

[0042] In an optional embodiment, the method further includes: when the target file type is not configured in the target annotation, querying the global rule configuration to determine the global file type, wherein the global rule configuration is a rule configuration shared by multiple interfaces, and the global file type is a file type allowed to be transmitted by multiple interfaces; when the global file type does not match the current file type, determining that the currently transmitted file is an abnormal file.

[0043] It can be understood that when the target annotation (such as @FileTypeCheck) does not explicitly configure the target file type, a global rule query can be used for processing. The aspect logic checks the configuration of the target annotation. If the file type attribute in the annotation is not set or is set to the default value (for example, it is set to null, that is, an empty value), the aspect will query the predefined global rule configuration. The global rule configuration is a centralized set of rules shared by multiple file upload interfaces, which contains all file types allowed to be uploaded. The file type list defined in the global rule configuration is regarded as a global file type, which can include various common and safe file formats, such as images, documents, audio and video files, etc., but excludes types that may cause security issues, such as executable files, script files, etc. The global file type list is compared with the actual type of the currently uploaded file. If the type of the current file is not in the global file type list, that is, the two do not match, the aspect will determine that the currently uploaded file is an abnormal file, and will not allow it to be uploaded. The exception handling mechanism will be triggered and an error message will be returned to the client.

[0044] Through the above processing, the design allows developers to maintain control over the security of file uploads without having to configure file type verification rules for each interface separately. At the same time, the existence of global rule configuration can also achieve unified management and update of file type verification rules for all interfaces, improving the maintainability and security of file upload logic. When the file type verification rules need to be changed, only the global configuration needs to be modified, without modifying the annotations on the interface one by one, which greatly simplifies maintenance work.

[0045] Step S106: When the target file type does not match the current file type, it is determined that the currently transmitted file is an abnormal file.

[0046] It can be understood that the file type allowed in the target annotation is compared with the actual type of the current file. If the two do not match, that is, the type of the uploaded file is not in the list of allowed file types, the system will determine that the current file is an abnormal file and prevent it from being uploaded.

[0047] In an optional embodiment, after determining that the currently transmitted file is an abnormal file, the method further includes: sending the currently transmitted file to a global abnormality handler; and sending abnormal file prompt information to the account that uploaded the currently transmitted file.

[0048] It can be understood that once the file type verification fails, the aspect will send the current transfer file to the global exception handler. The global exception handler (such as a unified exception handler) is a component that is specifically responsible for handling and recording exceptions. It can capture various abnormal events in the system and execute corresponding processing logic. After receiving the abnormal file information, the global exception handler will analyze the specific reasons for the failure to upload the file (such as file type mismatch) and record this information to facilitate subsequent error troubleshooting and auditing. After that, a prompt message for the abnormal file is generated, indicating the reason for the failure to upload the file and the corrective measures that the user may need to take. The prompt message of this abnormal file is sent to the user account that uploaded the file through an appropriate method (such as email, SMS, system message or interface response).

[0049] Through this embodiment, the system can not only intercept and process abnormal files, but also promptly feedback abnormal information to users, helping users to identify problems more quickly and take corrective measures, thereby improving the system's interactivity and user experience, while also enhancing the system's security.

[0050] Optionally, in order to further enhance the security and protection capabilities of the file upload application scenario, especially in the face of potential network attacks, a detection mechanism for abnormal files uploaded from the same address within a short period of time can be introduced.

[0051] When the slice determines that the uploaded file is an abnormal file, in addition to sending the file information to the global exception handler, it also records the upload timestamp of the file and the source address of the uploaded file for subsequent attack detection and analysis.

[0052] The aspect continuously detects abnormal file upload records and identifies potential abnormal upload patterns by analyzing parameters such as IP (Internet Protocol) addresses, time intervals, and upload frequencies. For example, if a large number of abnormal files are uploaded from the same IP address in a short period of time, it will be considered an attack attempt. The aspect can also set judgment thresholds. For example, receiving more than 5 abnormal file upload requests from the same address within 30 seconds can be used as a trigger condition. In addition, more complex algorithms are used to analyze upload patterns, such as anomaly detection algorithms or machine learning models, to improve the accuracy and robustness of detection.

[0053] Once the system detects that the frequency of uploading abnormal files from the same address exceeds the set threshold, the security response mechanism will be triggered immediately. For example: temporarily block the IP address to prevent further upload attempts. Or send an alert to the system administrator to notify possible network attack activities. Record detailed attack attempt information, including uploaded files, timestamps, and source addresses, to provide data support for subsequent analysis. During the period when the attack attempt is determined, increase the verification strength of subsequent upload requests.

[0054] In an optional embodiment, the method further includes: determining multiple candidate extensions of the target file type; and determining that the target file type does not match the current file type when the current file type does not match any of the multiple candidate extensions.

[0055] It can be understood that when performing file type verification, the aspect adopts a file extension comparison strategy to improve the accuracy of file type judgment. First, multiple candidate extensions of the target file type are determined. The candidate extensions can be defined in the global configuration or target annotation. For example, if the target file type is an image file, then ".hpg", ".hpeg", ".png", ".gif", etc. can be selected as the configured candidate extensions. When the file transfer method is called, the aspect will obtain the actual extension of the current file by parsing the target annotation. The aspect can compare the extension of the current file with the candidate extension list of the target file type to check whether the current file extension is among the candidate extensions. If the extension of the current file does not match any candidate extension of the target file type, it will be determined that the target file type does not match the current file type. It is considered that the currently uploaded file does not belong to the file type allowed to be uploaded by the system, and there is a security risk or it does not comply with business rules.

[0056] By using the above processing, through the comparison of specific extension names, the accuracy of the comparison processing can be further improved on the basis of fuzzy matching through file types (such as MIME types), thereby ensuring the accuracy and security of file type verification and ensuring that the type of uploaded files complies with the security and business rules set by the system.

[0057] Through the above step S102, it is detected that the transmission method carrying the target annotation is called, and the transmission method is intercepted, wherein the transmission method is a method for implementing the file transfer function of the target interface; step S104, determine the target file type indicated in the target annotation to allow the execution of the transmission method, and the current file type of the current transmission file of the transmission method; step S106, when the target file type does not match the current file type, determine that the current transmission file is an abnormal file. The purpose of decoupling the verification logic of file upload and the upload business logic can be achieved, and the technical effect of reducing the coupling degree between the verification logic and the upload business logic and improving the flexibility of code maintenance is achieved, thereby solving the technical problem that the verification logic of file upload and the upload business logic in the related technology are highly coupled, resulting in large limitations on code maintenance.

[0058] Figure 2 is a second flow chart of the file transfer control method according to an embodiment of the present application, such as Figure 2 As shown, the execution subject includes a section interceptor and a configuration component. The method includes the following steps:

[0059] Step S202, the configuration component uses the target annotation to annotate the transmission method of the target interface for realizing the file transmission function;

[0060] Step S204, the aspect interceptor detects that the transmission method carrying the target annotation is called, and intercepts the transmission method; determines the target file type indicated in the target annotation that allows the execution of the transmission method, and the current file type of the current transmission file of the transmission method; if the target file type does not match the current file type, determines that the current transmission file is an abnormal file.

[0061] It can be understood that precise control of file transfer types can be achieved through the cooperation of aspect interceptors and configuration components. The configuration component uses the target annotation to mark the interface that requires file type verification, and the annotation contains the allowed file type information. When the annotated transfer method is called, the aspect interceptor intervenes to check whether the file type specified by the annotation is consistent with the actual uploaded file type. If there is a mismatch, the uploaded file is considered an exception, triggering the security mechanism, blocking the upload and providing feedback to the user. Through the above processing, not only the amount of code is reduced and the development efficiency is improved, but also the security of the system is enhanced, allowing more flexible management and updating of file type rules, effectively preventing the upload of non-compliant files, and reducing potential security risks.

[0062] In an optional embodiment, the configuration component uses target annotations to annotate the transmission method defined by the target interface to implement the file transfer function, including: the configuration component determines the update annotation based on the configuration update instruction; the configuration component uses the update annotation to update the annotation of the transmission method of the target interface.

[0063] It can be understood that the configuration component can dynamically adjust the security policy for file uploads based on the configuration update instructions. When the security policy of the predetermined application environment needs to be updated, for example, the administrator discovers new potential threats or needs to relax restrictions on certain file types, the list and related security policies can be adjusted through configuration update instructions. The configuration component will determine whether the target annotation needs to be updated based on the new security policy. If the change in security policy affects the file type verification rules of a specific interface, the configuration component will generate corresponding update annotation instructions to update or add annotation information on those interfaces that require file verification. The aspect interceptor does not need to continuously monitor changes in the target annotation. It only needs to compare the file types indicated by the target annotation that are allowed to be uploaded with the current file types to ensure that the security of the uploaded files meets the latest security policy requirements.

[0064] In an optional embodiment, the configuration component determines an update annotation based on a configuration update instruction, including: the configuration component determines a security policy corresponding to a predetermined application environment based on a list of file types in the predetermined application environment, wherein the list of file types records file types having a risk level lower than a predetermined risk threshold in the predetermined application environment; and in the event that an update process is present in the security policy, an update annotation is determined based on the configuration update instruction.

[0065] It can be understood that the configuration component maintains a list of file types, which lists a series of file types that are assessed to have a risk level lower than the predetermined risk threshold according to the security requirements of the predetermined application environment. The maintenance and update of this list is based on the dynamic analysis of the potential threats of various file types, ensuring that only relatively safe file types can be uploaded, thereby reducing the security risk of the system. When the application environment or security requirements change and the security policy needs to be updated, the configuration component will re-evaluate the file type list and security policy based on the received configuration update instructions and generate corresponding update annotations. These update annotations are applied to those interface methods that require file type verification, thereby realizing the dynamic adjustment of file upload verification rules. The aspect technology will identify and respond to the update annotations at runtime to ensure that the verification rules for file upload are consistent with the latest security policy. This means that even if the business logic has not changed, the aspect interceptor will perform the latest file type verification based on the updated annotation information to ensure system security. Through the above mechanism, the configuration component can update the security policy independently of the business code, which not only reduces the security-related hard coding in the business code, improves the maintainability and flexibility of the code, but also enhances the security protection capability of the system. Security policies can be adjusted independently without worrying about the impact on existing business logic, achieving a high degree of decoupling between business logic and security control, making the system more agile and secure in the face of changing risks.

[0066] Code decoupling is achieved through aspect-oriented programming (AOP) and annotation technology, and the logic of file type verification is encapsulated into the aspect, making the business logic (such as file upload, processing, etc.) independent of the security control logic. When developers write business logic, they only need to focus on the processing logic after the file is uploaded, without having to deal with the details of file type verification, thereby reducing the complexity of business code. Through custom annotations, the required file type verification rules can be declared on the business method without having to write the verification logic inside the method. This makes the verification configuration more flexible, easy to understand and maintain, and also avoids repeated coding of verification logic in multiple business methods.

[0067] It should be noted that the configuration component can dynamically adjust the file type list and verification rules based on the configuration update instructions without modifying the business code. Even if the verification rules or list change, the business logic does not need to be adjusted, which decouples the business logic from the configuration rules and improves the flexibility and responsiveness of the system. Through the above mechanism, the cross-cutting concern of file type verification is effectively separated from the business logic, and the modularization and decoupling of the code are achieved, which significantly improves the scalability, maintainability and security of the system.

[0068] Based on the above embodiments and optional embodiments, the present application proposes an optional implementation mode: Figure 3 is a first schematic diagram of an optional file transfer control method provided according to an embodiment of the present application, such as Figure 3 As shown, the file transfer control method uses AOP's aspect technology, unified exception handling technology, Java reflection technology, and Java annotation technology. First, the annotation is added to the file upload interface through the custom Java annotation technology, and an attribute (i.e., custom annotation) contained in the annotation that allows the upload of file types is determined. Secondly, the AOP technology is used to intercept the aspect (i.e., aspect interceptor) to intercept the interface to add the annotation, and based on the aspect attribute value obtained by Java reflection technology, it is determined whether the file type that needs to be verified is specified. If it is not specified, the global rule configuration is queried for verification. If it is specified, it is verified according to the specified type. Finally, the unified exception handler of the unified exception handling technology is used to handle file verification exceptions and return corresponding prompts to the user.

[0069] Figure 4 is a first schematic diagram of an optional file transfer control method provided according to an embodiment of the present application, the steps of the file transfer control method are as follows Figure 4 As shown, the following is explained in steps. Step S1, custom Java annotation, the annotation contains attributes: the file types allowed to be uploaded, the default value is null. Define a custom annotation for identifying the file upload method. The annotation contains an attribute for specifying the file types allowed to be uploaded, and the default value is null, indicating that it is not specified. By defining annotations, the metadata of file type verification can be separated from the implementation of business methods, which makes the business logic purer and not interfered by security verification logic.

[0070] Step S2, add annotations to the upload file type interface. If you need to configure the file type verification rules separately, specify the corresponding attribute values ​​in the annotations. Add the above custom annotations to the interface method that implements the file upload function. If the business logic requires specific file type verification rules, these rules can be specified as attribute values ​​of the annotation. This step realizes the loose coupling between the interface method and the verification rules, that is, the interface method only needs to declare the need for verification, and the specific rules of the verification can be flexibly configured and modified externally.

[0071] Step S3, AOP aspect technology intercepts the annotated method to determine whether the file type that needs to be verified is specified. If it is not specified, the global rule configuration is queried for verification. If it is specified, it is verified according to the specified type. The key decoupling step is achieved through aspect interception technology. The aspect interceptor monitors all methods marked with custom annotations and automatically executes the file type verification logic. If the file type is not specified in the annotation, the aspect will query the global rule configuration; if the file type is specified, it will be verified according to the specified type. In this way, the aspect assumes the role of file type verification, and the business method only needs to focus on its core functions without worrying about the specific verification implementation, which greatly reduces the coupling of the code.

[0072] Step S4: If the verification is passed, the subsequent logic processing is released; if the verification is not passed, an exception is thrown. After the file type verification is passed, the aspect is released and the method continues to execute its business logic. If the verification fails, the aspect will throw an exception to prevent further execution of the method. In this way, the verification logic is independent of the business logic, which not only ensures security but also avoids the complexity of the business logic.

[0073] Step S5: If an exception is thrown, the global unified exception handler will intercept and process it, and return a prompt that the file type does not need to be uploaded. The global unified exception handler is responsible for capturing and processing all verification failure exceptions thrown by the aspect, and returning a clear file type upload failure prompt to the user. This centralized exception handling method once again separates the exception handling logic from the business logic, improving the robustness of the system and user experience.

[0074] Step S6: The front-end controller obtains the final execution result and returns it to the user. The front-end controller receives the result after verification and business processing from the back-end, and feeds back the final execution status to the user. This process decouples user interaction from the back-end processing logic. The front-end controller does not need to care about the specific implementation details of the back-end, but only needs to process the final response result, which simplifies the implementation and maintenance of the front-end.

[0075] The above optional implementation methods achieve at least the following effects: The solution of the present application realizes unified interception verification of the file types uploaded by the JavaWeb system through the application of aspect technology, reducing the amount of code that needs to be written. It can flexibly handle changes in the file upload type verification rules. For global configurations, when changes occur, it is only necessary to modify the configuration rules. For special upload file type rule changes for a single interface, it is only necessary to modify the value of the annotation on the corresponding interface. The logic of verifying file types is concentrated on aspects, annotations, and unified configurations, which improves the reusability and maintainability of the code. At the same time, it can flexibly adapt to different rules, making modifications more centralized and convenient.

[0076] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0077] In this embodiment, a file transfer control device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0078] According to an embodiment of the present application, a device embodiment for implementing a file transfer control method is also provided. Figure 5 is a schematic diagram of a file transmission control device according to an embodiment of the present application, such as Figure 5 As shown, the above-mentioned file transfer control device includes: a slice interception module 502, a file type determination module 504, and an abnormality identification module 506. The device is described below.

[0079] A slice interception module 502 is used to detect that a transmission method carrying a target annotation is called and intercept the transmission method, wherein the transmission method is a method for implementing a file transmission function of a target interface;

[0080] A file type determination module 504, connected to the slice interception module 502, is used to determine the target file type indicated in the target annotation that the transmission method is allowed to be executed, and the current file type of the current transmission file of the transmission method;

[0081] The abnormality identification module 506 is connected to the file type determination module 504 and is used to determine that the current transmission file is an abnormal file when the target file type does not match the current file type.

[0082] In a file transfer control device provided by an embodiment of the present application, a section interception module 502 is set to detect that a transfer method carrying a target annotation is called and intercept the transfer method, wherein the transfer method is a method for realizing the file transfer function of the target interface; a file type determination module 504 is connected to the section interception module 502 and is used to determine the target file type indicated in the target annotation to allow the execution of the transfer method, and the current file type of the current transfer file of the transfer method; an exception identification module 506 is connected to the file type determination module 504 and is used to determine that the current transfer file is an abnormal file when the target file type does not match the current file type. The purpose of decoupling the verification logic of file upload and the upload business logic is achieved, and the technical effect of reducing the coupling degree between the verification logic and the upload business logic and improving the flexibility of code maintenance is achieved, thereby solving the technical problem that the verification logic of file upload and the upload business logic in the related technology are highly coupled, resulting in large limitations on code maintenance.

[0083] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0084] It should be noted that the above-mentioned section interception module 502, file type determination module 504, and abnormality identification module 506 correspond to steps S102 to S106 in the embodiment, and the examples and application scenarios implemented by the above-mentioned modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment. It should be noted that the above-mentioned modules can be run in a computer terminal as part of the device.

[0085] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0086] The above-mentioned file transfer control device may also include a processor and a memory. The slice interception module 502, the file type determination module 504, the exception identification module 506, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0087] The processor includes a kernel, which retrieves the corresponding program unit from the memory. There can be one or more kernels. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0088] An embodiment of the present application provides a non-volatile storage medium on which a program is stored, and when the program is executed by a processor, a file transfer control method is implemented.

[0089] The embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and can be run on the processor. When the processor executes the program, the following steps are implemented: detecting that a transmission method carrying a target annotation is called, intercepting the transmission method, wherein the transmission method is a method for implementing a file transfer function of a target interface; determining the target file type indicating that the transmission method is allowed to be executed in the target annotation, and the current file type of the current transmission file of the transmission method; when the target file type does not match the current file type, determining that the current transmission file is an abnormal file. The device in this article can be a server, a PC, etc.

[0090] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: detecting that a transmission method carrying a target annotation is called, intercepting the transmission method, wherein the transmission method is a method for implementing a file transfer function of a target interface; determining a target file type indicated in the target annotation that allows execution of the transmission method, and a current file type of a current transmission file of the transmission method; and determining that the current transmission file is an abnormal file when the target file type does not match the current file type.

[0091] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0092] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0093] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0095] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0096] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0097] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0098] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0100] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A file transfer control method, characterized in that: include: It is detected that a transmission method carrying a target annotation is called, and the transmission method is intercepted, wherein the transmission method is a method for implementing a file transmission function of a target interface; Determining the target file type indicated in the target annotation as allowing execution of the transfer method, and the current file type of the current transfer file of the transfer method; In the case that the target file type does not match the current file type, it is determined that the currently transmitted file is an abnormal file.

2. The method according to claim 1, characterized in that The method further comprises: In the case that the target file type is not configured in the target annotation, query the global rule configuration to determine the global file type, wherein the global rule configuration is a rule configuration shared by multiple interfaces, and the global file type is a file type allowed to be transmitted by the multiple interfaces; In the case that the global file type does not match the current file type, it is determined that the currently transmitted file is an abnormal file.

3. The method according to claim 1, characterized in that After determining that the currently transmitted file is an abnormal file, the method further includes: Sending the current transmission file to a global exception handler; Send a prompt message of abnormal file to the account that uploaded the currently transferred file.

4. The method according to claim 1, characterized in that: The method further comprises: Determine multiple candidate extensions of the target file type; In a case where the current file type does not match any of the multiple candidate extensions, it is determined that the target file type does not match the current file type.

5. The method according to any one of claims 1 to 4, characterized in that: Before detecting that a transmission method carrying a target annotation is called and intercepting the transmission method, the method further includes: In the case where there are multiple interfaces with different execution functions, and the multiple interfaces respectively define candidate methods corresponding to the execution functions, based on a predetermined file transfer requirement, determining the transmission method that needs to be intercepted from the candidate methods respectively corresponding to the multiple interfaces; Based on the transmission method, a cut-off point of the aspect interceptor for executing the interception behavior is determined.

6. A file transfer control method, characterized in that: include: The configuration component uses target annotations to annotate the transfer method of the target interface for implementing the file transfer function; The aspect interceptor detects that the transmission method carrying the target annotation is called, and intercepts the transmission method; determines the target file type indicated in the target annotation that allows the transmission method to be executed, and the current file type of the current transmission file of the transmission method; In the case that the target file type does not match the current file type, it is determined that the currently transmitted file is an abnormal file.

7. The method according to claim 6, characterized in that The configuration component uses target annotations to annotate the transfer method defined by the target interface to implement the file transfer function, including: The configuration component determines an update annotation based on the configuration update instruction; The configuration component uses the update annotation to update the annotation of the transmission method of the target interface.

8. The method according to claim 7, characterized in that The configuration component determines the update annotation based on the configuration update instruction, including: The configuration component determines a security policy corresponding to the predetermined application environment based on a list of file types in the predetermined application environment, wherein the list of file types records file types in the predetermined application environment whose risk levels are lower than a predetermined risk threshold; In the case where the security policy is updated, the update annotation is determined based on the configuration update instruction.

9. A section interceptor, characterized in that: A file transfer control method applied to any one of claims 1 to 5.

10. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the file transfer control method described in any one of claims 1 to 8.

Images