Implementation of Servlet File Download Function

What about the Servlet File Download function? In Servlet/JSP, how does one use HTTP Protocol to implement dynamic file download service. This function is used in system development and has encountered several problems. I want to share my experience with you and hope to help you.

1. Problems with ms ie version

 
 

  
  
If (request. getHeader ("User-Agent"). indexOf ("MSIE 5.5 ")! =-1 ){
  
  
 
  
  
// MS IE5.5 has to be specially handled
  
  
 
  
  
Response. setHeader ("Content-Disposition ",
  
  
 
  
  
"Filename= "+ New String (f_name.getBytes (" Big5 "),"ISO8859_1"));
  
  
 
  
  
}
  
  
 
  
  
Else {
  
  
 
  
  
// Non-IE5.5 Header setting method
  
  
 
  
  
Response. addHeader ("Content-Disposition ",
  
  
 
  
  
"Attachment;Filename= "+ New String (f_name.getBytes (" Big5 "),"ISO8859_1"));
  
  
 
  
  
}
 
 

In IE 5.5, the keyword attachment cannot be added. This is a strange version.

2. download the Chinese file name, such as the syntax in the previous program block. You can simply change the file name to "ISO8859_1" encoding. I have tested Tomcat, Oracle 9ias, sun One can download the document name normally, and the advantage is that no package is required.

3. After the file is downloaded, add the following two lines of commands:

Response. setStatus (response. SC _ OK );

Response. flushBuffer ();

These two lines have not been added before, and can often be added in error. the error message "Connection rest by peer" is displayed in the log. What's more serious is that the servlet/jsp to be downloaded will not end. It takes a long time to get Timeout, if the number of downloads is large, the AP Server will be miserable. Therefore, it is best to add these two lines of commands to a program for dynamic file download.

4. For security considerations, sometimes the Write Program is lazy and uses dumpfile. jsp? F_name = attach/a.txt. If the name parameter of the uploaded file is not filtered out in the program, it cannot be mixed with "..", imagine if someone intentionally changes the parameter to this? Dumpfile. jsp? F_name =.../../a.txt, hey, all the files in the system have been downloaded.

These two lines have not been added before, and can often be added in error. the error message "Connection rest by peer" is displayed in the log. What's more serious is that the servlet/jsp to be downloaded will not end. It takes a long time to get Timeout, if the number of downloads is large, the AP Server will be miserable. Therefore, it is best to add these two lines of commands to a program for dynamic file download.

5. For security considerations, sometimes the Write Program is lazy and uses dumpfile. jsp? F_name = attach/a.txt. If the name parameter of the uploaded file is not filtered out in the program, it cannot be mixed with "..", imagine if someone intentionally changes the parameter to this? Dumpfile. jsp? F_name =.../../a.txt, hey, all the files in the system have been downloaded.

The above are all the mistakes I have made. For your reference.

 
 

  
  
import java.io.*;  
  
  
import java.util.*;  
  
  
import javax.servlet.*;  
  
  
import javax.servlet.http.*;  
  
  
 
  
  
public classDownload extends HttpServlet  
  
  
{  
  
  
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException  
  
  
{  
  
  
try  
  
  
{ 
 
 

// Here you can do other things

 
 

  
  
Response. setContentType ("application/octet-stream ");
  
  
Response. setHeader ("Content-Disposition", "attachment;Filename= \ "The name of the saved file to be displayed in the SAVE window \"");
  
  
 
  
  
ServletOutputStreamOut=Response. GetOutputStream ();
  
  
BufferedReaderBr=NewBufferedReader (new FileReader (name of the file to be downloaded ));
  
  
 
  
  
StringLine=Br. ReadLine ();
  
  
While (line! = Null)
  
  
{
  
  
Out. write (line. getBytes ());
  
  
Out. println ();
  
  
Line=Br. ReadLine ();
  
  
}
  
  
Out. close ();
  
  
Br. close ();
  
  
}
  
  
Catch (Exception e)
  
  
{
  
  
System. out. println (e );
  
  
}
  
  
}
  
  
Public void doPost (HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
  
  
{
  
  
DoGet (request, response );
  
  
}
  
  
}
 
 

That's simple.

Note: To solve the problem, change BIG5 In the first reference to GBK:

New String (name. getBytes ("GBK"), "ISO8859_1 ")

There is a problem with the code downloaded above. Only character-class files can be downloaded. errors may occur in binary files. Use the following code instead.

 
 

  
  
BufferedInputStream in = null;  
  
  
ServletOutputStream out = null;  
  
  
FileInputStream stream = null;  
  
  
try {  
  
  
out = response.getOutputStream();  
  
  
stream = new FileInputStream(file);  
  
  
 
  
  
int bytesRead = 0;  
  
  
final int length = 8192;  
  
  
byte[] buffer = new byte[length];  
  
  
while ((bytesRead = stream.read(buffer, 0, length)) != -1) {  
  
  
// write at server side  
  
  
out.write(buffer, 0, bytesRead);  
  
  
}  
  
  
} catch (IOException e) {  
  
  
throw new BPDBusiException(  
  
  
ResourceConst.SCORECARD_ERR_DOWNLOADATTACHMENT_DOWNLOAD);  
  
  
} finally {  
  
  
if (in != null) {  
  
  
in.close();  
  
  
}  
  
  
if (out != null) {  
  
  
out.close();  
  
  
}  
  
  
} 
 
 

The implementation of the Servlet File Download function is actually a call of some methods. It is helpful for your development idea to explain the Implementation of The Servlet File Download function.

1. At the beginning of JSP Servlet Development
2. Enhanced Servlet and JSP security without modifying code
3. Servlet and JSP paths
4. How to Improve Servlet and JSP Application Efficiency
5. Functions and principles of several encodings in JSP and Servlet