如何通过网络上传文件?

How do I upload a file to my servlet or JSP?
On the client side, the client's browser must support form-based upload. Most modern browsers do, but there's no guarantee. For example,
 
   
The input type "file" brings up a button for a file select box on the browser together with a text field that takes the file name once selected. The servlet can use the GET method parameters to decide what to do with the upload while the POST body of the request contains the file data to parse.

When the user clicks the "Upload" button, the client browser locates the local file and sends it using HTTP POST, encoded using the MIME-type multipart/form-data. When it reaches your servlet, your servlet must process the POST data in order to extract the encoded file. You can learn all about this format in RFC 1867.

Unfortunately, there is no method in the Servlet API to do this. Fortunately, there are a number of libraries available that do. Some of these assume that you will be writing the file to disk; others return the data as an InputStream.

Jason Hunter's MultipartRequest (available from http://www.servlets.com)

Apache Jakarta Commons Upload (package org.apache.commons.upload) "makes it easy to add robust, high-performance, file upload capability to your servlets and web applications"

CParseRFC1867 (available from http://www.servletcentral.com).

HttpMultiPartParser by Anil Hemrajani, at the isavvix Code Exchange

There is a multipart/form parser availailable from Anders Kristensen (http://www-uk.hpl.hp.com/people/ak/java/, ak@hplb.hpl.hp.com) at http://www-uk.hpl.hp.com/people/ak/java/#utils.

JavaMail also has MIME-parsing routines (see the Purple Servlet References).

Jun Inamori has written a class called org.apache.tomcat.request.ParseMime which is available in the Tomcat CVS tree.

JSPSmart has a free set of JSP for doing file upload and download.

UploadBean by JavaZoom claims to handle most of the hassle of uploading for you, including writing to disk or memory.

There's an Upload Tag in dotJ

Once you process the form-data stream into the uploaded file, you can then either write it to disk, write it to a database, or process it as an InputStream, depending on your needs. See How can I access or create a file or folder in the current directory from inside a servlet? and other questions in the Servlets:Files Topic for information on writing files from a Servlet.

Please note that you can't access a file on the client system directly from a servlet; that would be a huge security hole. You have to ask the user for permission, and currently form-based upload is the only way to do that.

[This FAQ based on earlier posts by Thomas Moore, Detlef Pleiss (dpleiss@os-net.de), and others.]

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
文件漏洞是一种常见的网络安全漏洞,它允许攻击者将恶意文件到目标服务器上。这种漏洞通常存在于Web应用程序中,攻击者可以通过绕过应用程序的文件验证机制,将恶意文件到服务器上,并在后续的攻击中执行该文件文件漏洞可能导致以下安全问题: 1. 执行恶意代码:攻击者可以上包含恶意代码的文件,如Webshell(用于远程控制服务器)、木马程序等。一旦成功执行,攻击者可以获取服务器的控制权,进而进行其他恶意活动。 2. 数据泄露:攻击者可以上包含敏感信息的文件,如数据库备份文件、配置文件等。这些文件可能包含用户名、密码、API密钥等敏感信息,一旦泄露,可能导致严重的安全后果。 3. 服务器资源滥用:攻击者可以上大型文件或大量文件,导致服务器资源被滥用,如磁盘空间耗尽、带宽消耗等,从而影响正常的服务运行。 为了防止文件漏洞的发生,开发人员应该采取以下措施: 1. 文件类型验证:限制上文件的类型和扩展名,只允许上安全的文件类型。 2. 文件内容验证:检查上文件的内容,确保其符合预期的格式和结构。 3. 文件名处理:对上文件文件名进行过滤和处理,防止恶意文件名的利用。 4. 文件存储位置:将上文件存储在安全的位置,并设置适当的访问权限,防止恶意文件的执行。 5. 安全配置:确保服务器和应用程序的安全配置,如禁用不必要的文件功能、限制上文件大小等。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值