文件下载漏洞

@RequestMapping("file")
public class FileDownloadController {
    
    @GetMapping("down")
    public void download(@RequestParam("p") String path, HttpServletResponse response) {
        try {
            File f = new File(path);
            String filename = f.getName();
            FileInputStream fileInputStream = new FileInputStream(f);
            InputStream inputStream = new BufferedInputStream(fileInputStream);
            byte[] buffer = new byte[inputStream.available()];
           服务器托管网 inputStream.read(buffer);
            inputStream.close();
            response.reset();
            
            response.setCharacterEncoding("UTF-8");
            response.addHeader("Content-Disposition", "attachment;filename=" + URLEncoder.encode(filename, "UTF-8"));
            response.addHeader("Content-Length", "" + f.length());
            OutputStream outputStream = new BufferedOutputStream(response.getOutpu服务器托管网tStream());
            response.setContentType("application/octet-stream");
            outputStream.write(buffer);
            outputStream.flush();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}