Path traversal

[QiAnXinCodeSafe]

Create a new file in the handle() in UpdateUploadHandler.java by intercepting the second half of the request uri as the file name.

Since the uri is controlled by the user, the attacker may construct a uri with "../", which will overwrite the sensitive files outside the folder when the file is created.