2021-03-19

流的安全关闭 安全测试问题 Unreleased Resource: Streams

先创建先关闭，每个流单独关闭

public static void downloadLocal(String filePath, HttpServletResponse response) {
		InputStream inStream = null;
		OutputStream outStream = null;
		try {
			inStream = new FileInputStream(filePath);
			outStream = response.getOutputStream();
			response.reset();
			response.setCharacterEncoding(Constants.charset_uf8);
			response.setContentType("application/octet-stream");
			response.addHeader("Content-Disposition",
					"attachment;filename=" + URLEncoder.encode(Tool.getFileName(filePath), Constants.charset_uf8));
			response.addHeader("Content-length", Tool.getExactFileSize(filePath) + "");
			byte[] b = new byte[1024];
			int len;
			while ((len = inStream.read(b)) > 0) {
				outStream.write(b, 0, len);
			}
		} catch (FileNotFoundException e) {
			throw new BusinessException("找不到下载文件");
		} catch (IOException e) {
			throw new BusinessException("下载文件错误 " + e.getMessage());
		} finally {
			try {
				if (inStream != null) {
					inStream.close();
				}
			} catch (IOException e) {
				throw new RuntimeException("关闭IO流错误 " + e.getMessage());
			}
			try {
				if (outStream != null) {
					outStream.close();
				}
			} catch (IOException e) {
				throw new RuntimeException("关闭IO流错误 " + e.getMessage());
			}
		}
	}