diff --git a/src/controller/bb/uploadController.js b/src/controller/bb/uploadController.js
new file mode 100644
index 0000000..7bec510
--- /dev/null
+++ b/src/controller/bb/uploadController.js
@@ -0,0 +1,17 @@
+const Router = require('koa-router')
+const router = new Router()
+
+const service = require('../../service/uploadService')
+const valid = require('../../valid')
+
+router.post('/bb/upload', async(ctx, next) => {
+  let file = ctx.params.file
+  valid.string('file', file).is().include(['data:image/', ';base64'])
+  let type = file.substring(file.indexOf('data:image/')+11, file.indexOf(';base64,'))
+  let content = file.substring(file.indexOf(';base64,')+8)
+  let filename = `upload/${Math.random().toString(36).substr(2)}.${type}`
+  valid.string('file.type', type).is().of(['png', 'jpeg', 'jpg', 'gif'])
+  service.save({type, content, filename})
+  ctx.ok(`/${filename}`)
+})
+module.exports = router
\ No newline at end of file
diff --git a/src/router/admin.js b/src/router/admin.js
index b1d7975..b669d8b 100644
--- a/src/router/admin.js
+++ b/src/router/admin.js
@@ -1,6 +1,8 @@
 const Router = require('koa-router')
 const router = new Router()
 
+const uploadController = require('../controller/bb/uploadController')
+router.use('', uploadController.routes(), uploadController.allowedMethods())
 const weaponController = require('../controller/bb/weaponController')
 router.use('', weaponController.routes(), weaponController.allowedMethods())
 const userController = require('../controller/bb/accountController')
diff --git a/src/service/uploadService.js b/src/service/uploadService.js
new file mode 100644
index 0000000..43e9d7d
--- /dev/null
+++ b/src/service/uploadService.js
@@ -0,0 +1,22 @@
+const failError = require('../error/failError')
+const fs = require('fs')
+const path = require('path')
+
+module.exports = {
+  save: async(e) => {
+    let folderList = e.filename.split('/')
+    let folder = ''
+    for(let i=0; i<folderList.length-1; i++) {
+      folder = path.join(folder, folderList[i])
+      if (!fs.existsSync(folder)) {
+        fs.mkdirSync(folder)
+      }
+    }
+    let buffer = Buffer.from(e.content, 'base64')
+    try {
+      await fs.promises.writeFile(e.filename, buffer)
+    } catch(err) {
+      throw new failError(`write file to ${e.filename}`)
+    }  
+  },
+}
\ No newline at end of file
diff --git a/src/valid/validString.js b/src/valid/validString.js
index 3576a2c..2143dc6 100644
--- a/src/valid/validString.js
+++ b/src/valid/validString.js
@@ -31,10 +31,16 @@ class validString {
     if ((this.v.length === 24 || this.v.length === 12) && isNaN(parseInt(this.v,16))!== true) throw new paramError(`${this.name}: ${this.showV}, must be mongodb id`)
     return this
   }
-  of(list) {
+  of(list) { // 考虑接受js可变参数
     if (!list.includes(this.v)) throw new paramError(`${this.name}: ${this.showV}, must one of ${list}`)
     return this
   }
+  include(list) { // 考虑接受js可变参数
+    for (let e of list) {
+      if (!this.v.includes(e)) throw new paramError(`${this.name}: ${this.showV}, must include all of ${list}`)
+    }
+    return this
+  }
 }
 
 module.exports = validString
\ No newline at end of file
diff --git a/tests/rest/bbAccount.spec.js b/tests/rest/bbAccount.spec.js
index 999a27f..0a1d569 100644
--- a/tests/rest/bbAccount.spec.js
+++ b/tests/rest/bbAccount.spec.js
@@ -7,7 +7,7 @@ const operator = require('../data/operator')
 
 const wait = require('../../src/util/wait')
 
-describe('bb user controller', () => {
+xdescribe('bb user controller', () => {
   let token
   let refreshToken
   it('save, delete', async() => {    
diff --git a/tests/rest/upload.spec.js b/tests/rest/upload.spec.js
new file mode 100644
index 0000000..56f5c7c
--- /dev/null
+++ b/tests/rest/upload.spec.js
@@ -0,0 +1,27 @@
+const {expect} = require('chai')
+const fetch = require('../../src/fetch')
+const config = require('../../config/env')
+const host = `http://localhost:${config.server.port}`
+const db = require('../../src/db')
+const operator = require('../data/operator')
+
+const wait = require('../../src/util/wait')
+
+describe('upload controller', () => {
+  let token
+  it('upload', async() => {
+    let rest = await fetch(`${host}/bb/upload`, {method: 'post', body: 'file=data:image/gif;base64,R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs=', headers: {authorization: token}})
+    expect(rest.code).to.be.deep.equal('SUCCESS')
+  })
+
+  before(async() => {
+    await db.drop()
+    operator.saveAccount()
+    await wait(50) // 不然有可能数据还没插进去
+    let rest = await fetch(`${host}/bb/login`, {method: 'post', body: 'username=admin&password=111111'})    
+    token = `Bearer ${rest.data.token}`   
+  })
+  after(async() => {
+    // await db.drop()
+  })
+})
\ No newline at end of file
diff --git a/upload/llib3r5byzr.gif b/upload/llib3r5byzr.gif
new file mode 100644
index 0000000..e232d4a
Binary files /dev/null and b/upload/llib3r5byzr.gif differ
diff --git a/upload/zo3obbfn4id.gif b/upload/zo3obbfn4id.gif
new file mode 100644
index 0000000..e232d4a
Binary files /dev/null and b/upload/zo3obbfn4id.gif differ