危険な形式のファイルを無制限にアップロードできる

@PostMapping("/upload")
public String handleFileUpload(@RequestParam("file") MultipartFile file) throws IOException {
    // 利用者が指定したファイル名で保存
    String fileName = file.getOriginalFilename();
    File destinationFile = new File("/uploads/" + fileName);
    file.transferTo(destinationFile);
    return "uploadSuccess";
}

import java.io.IOException;
import java.nio.ByteBuffer;
import java.nio.charset.CharacterCodingException;
import java.nio.charset.CodingErrorAction;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardOpenOption;
import java.util.UUID;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile;

@RestController
public final class SafeUploadController {
    private static final Path UPLOAD_ROOT =
            Path.of("/var/lib/myapp/uploads").toAbsolutePath().normalize();
    private static final long MAX_TEXT_SIZE = 1024 * 1024;

    @PostMapping("/upload")
    public String handleFileUpload(@RequestParam("file") MultipartFile file) throws IOException {
        if (file.isEmpty() || file.getSize() > MAX_TEXT_SIZE) {
            throw new IOException("Invalid file size");
        }

        byte[] content = file.getBytes();
        String text;
        try {
            text = StandardCharsets.UTF_8.newDecoder()
                    .onMalformedInput(CodingErrorAction.REPORT)
                    .onUnmappableCharacter(CodingErrorAction.REPORT)
                    .decode(ByteBuffer.wrap(content))
                    .toString();
        } catch (CharacterCodingException e) {
            throw new IOException("The upload is not valid UTF-8 text", e);
        }
        if (text.codePoints().anyMatch(c -> c == 0
                || (Character.isISOControl(c) && c != '\n' && c != '\r' && c != '\t'))) {
            throw new IOException("Invalid text content");
        }

        String storedName = UUID.randomUUID() + ".txt";
        Path target = UPLOAD_ROOT.resolve(storedName).normalize();
        if (!target.startsWith(UPLOAD_ROOT)) {
            throw new IOException("Invalid upload destination");
        }

        // Webルート外にUPLOAD_ROOTを作成し、アップロードをコードとして実行させないでください。
        Files.write(target, content, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
        return "uploadSuccess";
    }
}