github-advanced-security[bot] commented on code in PR #839:
URL:
https://github.com/apache/hugegraph-toolchain/pull/839#discussion_r4354983795
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/auth/UserService.java:
##########
@@ -366,44 +367,47 @@
}
}
- public Map<String, Object> readCsvByCsvReader(File file) {
+ public List<Map<String, String>> readUserCsv(File file) {
if (file == null) {
throw new InternalException("auth.user.import-file.failed");
}
- Map<String, Object> mapData = new HashMap<>();
- String fileName = file.getName();
- mapData.put("sheetName", fileName);
-
- List<String> strList = new ArrayList<>();
- List<Map<String, Object>> list = new ArrayList<>();
- try {
- List<String[]> arrList = new ArrayList<String[]>();
- CsvReader reader = new CsvReader(file.getPath(), ',',
Charset.forName("UTF-8"));
- // 读取表头
- reader.readHeaders();
- String[] headArray = reader.getHeaders();
- while (reader.readRecord()) {
- // 按行读取，并把每一行的数据添加到list集合
- arrList.add(reader.getValues());
- }
- reader.close();
- // 如果要返回 String[] 类型的 list 集合，则直接返回 arrList
- // 以下步骤是把 String[] 类型的 list 集合转化为 String 类型的 list 集合
- for (int i = 0; i < arrList.size(); i++) {
- // 组装String字符串
- // 如果不知道有多少列，则可再加一个循环
- Map<String, Object> map = new HashMap<>();
- for (int j = 0; j < arrList.get(0).length; j++) {
- map.put("" + headArray[j] + "", arrList.get(i)[j]);
+ try (BufferedReader reader = Files.newBufferedReader(file.toPath(),
Review Comment:
## CodeQL / Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/97)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
