1

I want my servlet to receive files in some folder under the application directory tree. The server accepts files in multipart/form-data format. I've understood that @MultipartConfig is the right attribute to mark the servlet code, to allow the server to create files. However, not every location is considered as safe, hence two questions:

  1. Which are the limitations, when specifying the locations for file-upload servlets
  2. Can the paths be relative to application path or they should be absolute?
  3. The files must be downloadable afterwards, so in general, which is a best place on the server to keep the files it (under the application tree, out of the tree, out of Tomcat tree etc?)
  4. Since annotation seems to be a very 'static' way to allow servlet download things, can the same be specified in web.xml, for example?

Thanks!

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
BreakPhreak
  • 10,940
  • 26
  • 72
  • 108

1 Answers1

5

1: Which are the limitations, when specifying the locations for file-upload servlets

It needs to be readable and writable. It also needs to be an existing location, the servletcontainer won't precreate it for you in case of absence.

2: Can the paths be relative to application path or they should be absolute?

Both are allowed, as long as 1) is confirmed. The container will under the covers use java.io.File to denote the location. So using relative paths is definitely a bad idea.

3: The files must be downloadable afterwards, so in general, which is a best place on the server to keep the files it (under the application tree, out of the tree, out of Tomcat tree etc?)

Putting in webapp folder will cause them all get lost whenever you redeploy the webapp. It also won't work on some server configs since extraction of the WAR file is an optional configuration setting. So it's really better to put them on a fixed path outside the webapp folder. To download them again, just add a new <Context> to Tomcat or create a servlet which gets a FileInputStream from it and writes to OutputStream of the response. Examples can be found in this answer.

4: Since annotation seems to be a very 'static' way to allow servlet download things, can the same be specified in web.xml, for example?

Yes, you can just ignore the location attribute of the annotation altogether and use Part#getInputStream() to write it to the desired location. You can then specify the location as <init-param> of the servlet and initialize it in init() method.

Community
  • 1
  • 1
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
  • Thanks so much for the exhaustive answer! A short question if I may: currently, the upload dir is specified twice in my web.xml: one as a parameter to the uploading servlet, second time as a location under multipart-config. I understand that second is a must. Would it be wise to discard the servlet config parameter and somehow read the multipart-config/location from the deployment descriptor? If yes - which is the best way? If no - any suggestions will be welcomed. Sorry for the extra and thanks anyway! – BreakPhreak May 09 '11 at 15:48
  • 2
    The `location` is not required by `@MultipartConfig`. It will just be stored in server's temp folder. You can use `Part#getInputStream()` to get the input stream out of it so that you can write it to whatever location you want referenced by an `OutputStream`. – BalusC May 09 '11 at 15:49