fix(设备管理): 限制物模型导入使用托管文件

Closes: #766

Author: zhou-hao

jetlinks-components/io-component/src/main/java/org/jetlinks/community/io/excel/DefaultImportExportService.java

@@ -20,17 +20,13 @@
 import org.jetlinks.community.io.excel.easyexcel.ExcelReadDataListener;
 import org.jetlinks.community.io.file.FileManager;
 import org.jetlinks.community.io.utils.FileUtils;
-import org.springframework.core.io.Resource;
-import org.springframework.core.io.buffer.DataBuffer;
 import org.springframework.core.io.buffer.DataBufferUtils;
-import org.springframework.http.MediaType;
 import org.springframework.stereotype.Component;
-import org.springframework.web.reactive.function.client.WebClient;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
-import java.io.FileInputStream;
 import java.io.InputStream;
+import java.net.URI;
 
 import static org.hswebframework.reactor.excel.ReactorExcel.read;
 
@@ -41,13 +37,9 @@
 @Component
 public class DefaultImportExportService implements ImportExportService {
 
-    private WebClient client;
-
     private final FileManager fileManager;
 
-    public DefaultImportExportService(WebClient.Builder builder,
-                                      FileManager fileManager) {
-        client = builder.build();
+    public DefaultImportExportService(FileManager fileManager) {
         this.fileManager = fileManager;
     }
 
@@ -80,19 +72,29 @@ public <T> Flux<T> readData(String fileUrl, String fileId, RowWrapper<T> wrapper
     }
 
     public Mono<InputStream> getInputStream(String fileUrl) {
+        // 导入入口只接受平台托管文件 ID，避免由请求参数触发任意网络或本地文件访问。
+        return fileManager
+            .read(resolveFileId(fileUrl))
+            .as(DataBufferUtils::join)
+            .map(buffer -> buffer.asInputStream(true));
+    }
 
-        return Mono.defer(() -> {
-            if (fileUrl.startsWith("http")) {
-                return client
-                    .get()
-                    .uri(fileUrl)
-                    .accept(MediaType.APPLICATION_OCTET_STREAM)
-                    .exchangeToMono(clientResponse -> clientResponse.bodyToMono(Resource.class))
-                    .flatMap(resource -> Mono.fromCallable(resource::getInputStream));
-            } else {
-                return Mono.fromCallable(() -> new FileInputStream(fileUrl));
+    static String resolveFileId(String fileUrl) {
+        URI uri = URI.create(fileUrl);
+        if (!uri.isAbsolute()) {
+            if (fileUrl.contains("/") || fileUrl.contains("\\")) {
+                throw new IllegalArgumentException("Only managed file IDs are supported");
             }
-        });
+            return fileUrl;
+        }
 
+        String path = uri.getPath();
+        int filePathIndex = path == null ? -1 : path.lastIndexOf("/file/");
+        if (filePathIndex < 0) {
+            throw new IllegalArgumentException("Only managed file URLs are supported");
+        }
+        String fileName = path.substring(filePathIndex + "/file/".length());
+        int extensionIndex = fileName.indexOf('.');
+        return extensionIndex > 0 ? fileName.substring(0, extensionIndex) : fileName;
     }
 }

jetlinks-components/io-component/src/test/java/org/jetlinks/community/io/excel/DefaultImportExportServiceTest.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2026 JetLinks https://www.jetlinks.cn
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jetlinks.community.io.excel;
+
+import org.jetlinks.community.io.file.FileManager;
+import org.junit.jupiter.api.Test;
+import reactor.core.publisher.Flux;
+import reactor.test.StepVerifier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class DefaultImportExportServiceTest {
+
+    @Test
+    void shouldReadManagedFileInsteadOfRemoteUrl() {
+        FileManager fileManager = mock(FileManager.class);
+        when(fileManager.read("file-id")).thenReturn(Flux.empty());
+
+        DefaultImportExportService service = new DefaultImportExportService(fileManager);
+
+        StepVerifier
+            .create(service.getInputStream("http://localhost:8848/api/file/file-id.csv?accessKey=test"))
+            .verifyComplete();
+
+        verify(fileManager).read("file-id");
+    }
+
+    @Test
+    void shouldResolveManagedFileId() {
+        assertEquals("file-id", DefaultImportExportService.resolveFileId("file-id"));
+        assertEquals(
+            "file-id",
+            DefaultImportExportService.resolveFileId("http://localhost:8848/api/file/file-id.xlsx?accessKey=test")
+        );
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> DefaultImportExportService.resolveFileId("http://127.0.0.1/internal/secret.csv")
+        );
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> DefaultImportExportService.resolveFileId("/etc/passwd")
+        );
+    }
+}

jetlinks-manager/device-manager/src/main/java/org/jetlinks/community/device/web/DeviceInstanceController.java

@@ -1078,7 +1078,7 @@ public Mono<ValidationResult> deviceIdValidate2(@RequestParam @Parameter(descrip
     @SaveAction
     @Operation(summary = "解析文件为属性物模型")
     public Mono<String> importPropertyMetadata(@PathVariable @Parameter(description = "产品ID") String productId,
-                                               @RequestParam @Parameter(description = "文件地址,支持csv,xlsx文件格式") String fileUrl) {
+                                               @RequestParam @Parameter(description = "平台文件ID,支持csv,xlsx文件格式") String fileUrl) {
         return metadataManager
             .getMetadataExpandsConfig(productId, DeviceMetadataType.property, "*", "*", DeviceConfigScope.device)
             .collectList()

jetlinks-manager/device-manager/src/main/java/org/jetlinks/community/device/web/DeviceProductController.java

@@ -336,7 +336,7 @@ public Mono<Void> downloadExportPropertyMetadataTemplate(@PathVariable @Paramete
     @SaveAction
     @Operation(summary = "解析文件为属性物模型")
     public Mono<String> importPropertyMetadata(@PathVariable @Parameter(description = "产品ID") String productId,
-                                               @RequestParam @Parameter(description = "文件地址,支持csv,xlsx文件格式") String fileUrl) {
+                                               @RequestParam @Parameter(description = "平台文件ID,支持csv,xlsx文件格式") String fileUrl) {
         return configMetadataManager
             .getMetadataExpandsConfig(productId, DeviceMetadataType.property, "*", "*", DeviceConfigScope.product)
             .collectList()
@@ -355,4 +355,4 @@ public Mono<String> importPropertyMetadata(@PathVariable @Parameter(description
             });
     }
 
-}
+}