.....

examcloud-exchange-inner-api-provider/src/main/java/cn/com/qmth/examcloud/exchange/inner/api/controller/UpyunController.java

@@ -13,6 +13,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 import cn.com.qmth.examcloud.commons.base.exception.ExamCloudRuntimeException;
+import cn.com.qmth.examcloud.commons.base.exception.StatusException;
 import cn.com.qmth.examcloud.commons.base.util.AES;
 import cn.com.qmth.examcloud.commons.web.security.bean.User;
 import cn.com.qmth.examcloud.commons.web.support.ControllerSupport;
@@ -43,6 +44,10 @@ public class UpyunController extends ControllerSupport {
 
 		User accessUser = getAccessUser();
 
+		if (!fileSuffix.matches("\\w+")) {
+			throw new StatusException("EX-600100", "fileSuffix is wrong");
+		}
+
 		fileSuffix = "." + fileSuffix;
 
 		ServletInputStream in = null;