RealWorld 2024 Writeup

package be.more.elegant;

import com.opensymphony.xwork2.ActionSupport;
import java.io.File;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.servlet.http.HttpServletRequest;
import org.apache.commons.io.FileUtils;
import org.apache.struts2.action.ServletRequestAware;

public class HeaderIconAction extends ActionSupport implements ServletRequestAware {
  public static final File UPLOAD_DIR = new File(HeaderIconAction.class.getClassLoader().getResource("../../statics/").getFile(), "uploads");
  
  private HttpServletRequest request;
  
  private String uploadedPath;
  
  private File fileUpload;
  
  private String fileUploadContentType;
  
  private String fileUploadFileName;
  
  public String execute() throws Exception {
    return "input";
  }
  
  public String doUpload() {
    try {
      String remoteAddr = this.request.getRemoteAddr();
      String md5ForIp = md5Ip(remoteAddr);
      File sandBox = new File(UPLOAD_DIR, md5ForIp);
      File fileToCreate = new File(sandBox, this.fileUploadFileName);
      FileUtils.copyFile(this.fileUpload, fileToCreate);
      this.uploadedPath = "statics/uploads/" + md5ForIp + "/" + this.fileUploadFileName;
    } catch (Exception e) {
      return "error";
    } 
    return "success";
  }
  
  public String md5Ip(String ip) throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("MD5");
    md.update(ip.getBytes());
    byte[] digest = md.digest();
    StringBuilder sb = new StringBuilder();
    for (byte b : digest) {
      sb.append(String.format("%02x", new Object[] { Integer.valueOf(b & 0xFF) }));
    } 
    return sb.toString();
  }
  
  public File getFileUpload() {
    return this.fileUpload;
  }
  
  public void setFileUpload(File fileUpload) {
    this.fileUpload = fileUpload;
  }
  
  public String getFileUploadContentType() {
    return this.fileUploadContentType;
  }
  
  public void setFileUploadContentType(String fileUploadContentType) {
    this.fileUploadContentType = fileUploadContentType;
  }
  
  public String getFileUploadFileName() {
    return this.fileUploadFileName;
  }
  
  public void setFileUploadFileName(String fileUploadFileName) {
    this.fileUploadFileName = fileUploadFileName;
  }
  
  public String getUploadedPath() {
    return this.uploadedPath;
  }
  
  public void withServletRequest(HttpervletRequest httpServletRequest) {
    this.request = httpServletRequest;
  }
}