化境文件上传修改版.可检测任何木马

<%
'转载自http://bbs.7di.net
dim upfile_5xSoft_Stream
Class upload_5xSoft
  
dim Form,File,Version,Rex,Filter  
Private Sub Class_Initialize 
dim iStart,iFileNameStart,iFileNameEnd,iEnd,vbEnter,iFormStart,iFormEnd,theFile
dim strDiv,mFormName,mFormValue,mFileName,mFileSize,mFilePath,iDivLen,mStr
dim ExtName,tmpInfo,checkType,FielterStr
'要检查的文件扩展名,所有文件为".*"
checkType=".gif.jpg.txt.bmp.swf.jpeg.png"
 set Rex = New RegExp
 Filter=Chr(60)&Chr(37)&Chr(40)&Chr(46)&Chr(124)&Chr(92)&Chr(110)&Chr(41)&Chr(42)&Chr(37)&Chr(62)&Chr(124)&Chr(60)&Chr(115)&Chr(99)&Chr(114)&Chr(105)&Chr(112)&Chr(116)
 Rex.IgnoreCase = True
 Rex.Global = True

Version="化境编程界HTTP上传程序 Version 1.0"
if Request.TotalBytes<1 then Exit Sub
set Form=CreateObject("Scripting.Dictionary")
set File=CreateObject("Scripting.Dictionary")
set upfile_5xSoft_Stream=CreateObject("Adodb.Stream")
upfile_5xSoft_Stream.mode=3
upfile_5xSoft_Stream.type=1
upfile_5xSoft_Stream.open
upfile_5xSoft_Stream.write Request.BinaryRead(Request.TotalBytes)

vbEnter=Chr(13)&Chr(10)
iDivLen=inString(1,vbEnter)+1
strDiv=subString(1,iDivLen)
iFormStart=iDivLen
iFormEnd=inString(iformStart,strDiv)-1
while iFormStart < iFormEnd
  iStart=inString(iFormStart,"name=""")
  iEnd=inString(iStart+6,"""")
  mFormName=subString(iStart+6,iEnd-iStart-6)
  iFileNameStart=inString(iEnd+1,"filename=""")
  if iFileNameStart>0 and iFileNameStart<iFormEnd then
   iFileNameEnd=inString(iFileNameStart+10,"""")
   mFileName=subString(iFileNameStart+10,iFileNameEnd-iFileNameStart-10)
   iStart=inString(iFileNameEnd+1,vbEnter&vbEnter)
   iEnd=inString(iStart+4,vbEnter&strDiv)
   if iEnd>iStart then
    mFileSize=iEnd-iStart-4
   else
    mFileSize=0
   end if
   set theFile=new FileInfo
   theFile.FileName=getFileName(mFileName)
   theFile.FilePath=getFilePath(mFileName)
   theFile.FileSize=mFileSize
   theFile.FileStart=iStart+4
   theFile.FormName=FormName
   '非法代码检查-----------开始
   
   ExtName=lcase(GetExtName(theFile.FileName))
   if(instr(checkType,ExtName)<>0 or checkType=".*") then
    tmpInfo=subString(iStart,mFileSize)
 if tmpInfo&""<>"" then
  if CheckFilter(tmpInfo) then
    alert "文件["&theFile.FileName&"]包含非法内容,上传失败!"
    Response.end()
  end if
 end if
 Response.write tmpInfo&"<hr>"
   end if
   '非法代码检查-----------完成
   file.add mFormName,theFile
  else
   iStart=inString(iEnd+1,vbEnter&vbEnter)
   iEnd=inString(iStart+4,vbEnter&strDiv)
 
   if iEnd>iStart then
    mFormValue=subString(iStart+4,iEnd-iStart-4)
   else
    mFormValue="" 
   end if
   form.Add mFormName,mFormValue
  end if

  iFormStart=iformEnd+iDivLen
  iFormEnd=inString(iformStart,strDiv)-1
wend
End Sub

Private Function subString(theStart,theLen)
 dim i,c,stemp
 upfile_5xSoft_Stream.Position=theStart-1
 stemp=""
 for i=1 to theLen
   if upfile_5xSoft_Stream.EOS then Exit for
   c=ascB(upfile_5xSoft_Stream.Read(1))
   If c > 127 Then
    if upfile_5xSoft_Stream.EOS then Exit for
    stemp=stemp&Chr(AscW(ChrB(AscB(upfile_5xSoft_Stream.Read(1)))&ChrB(c)))
    i=i+1
   else
    stemp=stemp&Chr(c)
   End If
 Next
 subString=stemp
End function

Private Function inString(theStart,varStr)
 dim i,j,bt,theLen,str
 InString=0
 Str=toByte(varStr)
 theLen=LenB(Str)
 for i=theStart to upfile_5xSoft_Stream.Size-theLen
   if i>upfile_5xSoft_Stream.size then exit Function
   upfile_5xSoft_Stream.Position=i-1
   if AscB(upfile_5xSoft_Stream.Read(1))=AscB(midB(Str,1)) then
    InString=i
    for j=2 to theLen
      if upfile_5xSoft_Stream.EOS then 
        inString=0
        Exit for
      end if
      if AscB(upfile_5xSoft_Stream.Read(1))<>AscB(MidB(Str,j,1)) then
        InString=0
        Exit For
      end if
    next
    if InString<>0 then Exit Function
   end if
 next
End Function

Private Sub Class_Terminate  
  form.RemoveAll
  file.RemoveAll
  set form=nothing
  set file=nothing
  upfile_5xSoft_Stream.close
  set upfile_5xSoft_Stream=nothing
 set Rex=nothing
End Sub
   
 
 Private function GetFilePath(FullPath)
  If FullPath <> "" Then
   GetFilePath = left(FullPath,InStrRev(FullPath, "\"))
  Else
   GetFilePath = ""
  End If
 End  function
 
 Private function GetFileName(FullPath)
  If FullPath <> "" Then
   GetFileName = mid(FullPath,InStrRev(FullPath, "\")+1)
  Else
   GetFileName = ""
  End If
 End  function

 Private function GetExtName(FileName)'Return value include the string "."
  If FileName<>"" then
   GetExtName=mid(FileName,instrRev(FileName,"."))
  else
   GetExtName=""
  end if
 End function
 
 Private function toByte(Str)
   dim i,iCode,c,iLow,iHigh
   toByte=""
   For i=1 To Len(Str)
   c=mid(Str,i,1)
   iCode =Asc(c)
   If iCode<0 Then iCode = iCode + 65535
   If iCode>255 Then
     iLow = Left(Hex(Asc(c)),2)
     iHigh =Right(Hex(Asc(c)),2)
     toByte = toByte & chrB("&H"&iLow) & chrB("&H"&iHigh)
   Else
     toByte = toByte & chrB(AscB(c))
   End If
   Next
 End function
 
 Private function CheckFilter(str)
  Rex.Pattern=Filter
  CheckFilter=Rex.Test(str)
 End function

 Private Function Alert(msg)
 Response.Write "<script>alert("""&ToJS(msg)&""")</script>"
 'Response.End()
 End Function

 Private Function ToJS(intxt)
 intxt=intxt&""
 intxt=replace(intxt,chr(34),"\"&chr(34))
 intxt=replace(intxt,VBCR,"\n\"&VBCR)
 ToJS=intxt
 End Function

 Private function ASCT(str)
  dim val,tmp
  if str&""<>"" then
  for i=1 to len(str)
   tmp=asc(mid(str,i,1))
   if len(tmp)=1 then tmp="00"&tmp
   if len(tmp)=2 then tmp="0"&tmp
   val=val&tmp
  next
 end if
 ASCT=val
 End function

End Class

Class FileInfo
  dim FormName,FileName,FilePath,FileSize,FileStart
  Private Sub Class_Initialize 
    FileName = ""
    FilePath = ""
    FileSize = 0
    FileStart= 0
    FormName = ""
  End Sub
  
 Public function SaveAs(FullPath)
    dim dr,ErrorChar,i
    SaveAs=1
    if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" then exit function
    if FileStart=0 or right(fullpath,1)="/" then exit function
    set dr=CreateObject("Adodb.Stream")
    dr.Mode=3
    dr.Type=1
    dr.Open
    upfile_5xSoft_Stream.position=FileStart-1
    upfile_5xSoft_Stream.copyto dr,FileSize
    dr.SaveToFile FullPath,2
    dr.Close
    set dr=nothing 
    SaveAs=0
  end function
End Class
%>