B/S开发框架Web安全问题及防范规范之挂马和WebShell

/// <summary>
/// 上传文件信息
/// </summary>
public class UploadFileInfo
{
    /// <summary>
    /// 上传结果（true 成功  false 失败）
    /// </summary>
    public bool Result
    {
        get;
        set;
    }
    /// <summary>
    /// 上传说明
    /// </summary>
    public string ResultMsg
    {
        get;
        set;
    }
    /// <summary>
    /// 文件名称
    /// </summary>
    public string FileName
    {
        get;
        set;
    }
    /// <summary>
    /// 修改后文件名称
    /// </summary>
    public string NewFileName
    {
        get;
        set;
    }
    /// <summary>
    /// 文件路径
    /// </summary>
    public string FilePath
    {
        get;
        set;
    }
    /// <summary>
    /// 文件扩展名
    /// </summary>
    public string FileExtension
    {
        get;
        set;
    }
    /// <summary>
    /// 文件大小
    /// </summary>
    public int FileSize
    {
        get;
        set;
    }
}

/// <summary>
/// 文件上传帮助类
/// </summary>
public static class FileUploadHelper
{
    /// <summary>
    /// 文件上传
    /// </summary>
    /// <param name="postedFile">上传的文件</param>
    /// <param name="format">允许上传的文件格式</param>
    /// <param name="maxSize"></param>
    /// <param name="filePath">保存路径</param>
    /// <param name="savefileName">保存文件名(不含扩展名)</param>
    /// <returns></returns>
    public static UploadFileInfo Upload(HttpPostedFile postedFile, string format, int maxSize, string filePath, string saveFileName)
    {
        UploadFileInfo fileInfo = new UploadFileInfo();
        fileInfo.Result = true;
        fileInfo.FileName = Path.GetFileName(postedFile.FileName);
        fileInfo.FileExtension = Path.GetExtension(fileInfo.FileName);
        fileInfo.FileSize = postedFile.ContentLength;

        saveFileName = saveFileName + fileInfo.FileExtension;
        //验证上传文件的格式
        if (format.IndexOf(fileInfo.FileExtension) == -1)
        {
            fileInfo.Result = false;
            fileInfo.ResultMsg = "上传失败，上传文件格式不合法";
            return fileInfo;
        }
        if (fileInfo.FileSize > maxSize)
        {
            fileInfo.Result = false;
            fileInfo.ResultMsg = "上传失败，上传文件大小超出限制";
            return fileInfo;
        }
        try
        {
            string savePath = HttpContext.Current.Request.MapPath(filePath);
            //判断物理路径是否存在,若不存在则创建路径
            DirectoryInfo dir = new DirectoryInfo(savePath);
            if (!dir.Exists)
            {
                dir.Create();
            }
            fileInfo.FilePath = filePath + saveFileName;
            postedFile.SaveAs(savePath + saveFileName);
        }
        catch
        {
            fileInfo.Result = false;
            fileInfo.ResultMsg = "上传失败,发生异常";
            return fileInfo;
        }
        return fileInfo;
    }
}