Package org.apache.tomcat.util.http.fileupload.disk

Class DiskFileItemFactory

  • All Implemented Interfaces:
    FileItemFactory
    public class DiskFileItemFactory
extends java.lang.Object
implements FileItemFactory

    The default FileItemFactory implementation. This implementation creates FileItem instances which keep their content either in memory, for smaller items, or in a temporary file on disk, for larger items. The size threshold, above which content will be stored on disk, is configurable, as is the directory in which temporary files will be created.

    If not otherwise configured, the default configuration values are as follows:

    • Size threshold is 10KB.
    • Repository is the system default temp directory, as returned by System.getProperty("java.io.tmpdir").

    NOTE: Files are created in the system default temp directory with predictable names. This means that a local attacker with write access to that directory can perform a TOUTOC attack to replace any uploaded file with a file of the attackers choice. The implications of this will depend on how the uploaded file is used but could be significant. When using this implementation in an environment with local, untrusted users, setRepository(File) MUST be used to configure a repository location that is not publicly writable. In a Servlet container the location identified by the ServletContext attribute jakarta.servlet.context.tempdir may be used.

    Temporary files, which are created for file items, should be deleted later on.

    Since:
    FileUpload 1.1

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static int DEFAULT_SIZE_THRESHOLD
      The default threshold above which uploads will be stored on disk.

    • Constructor Summary

      Constructors 
      Constructor Description
      DiskFileItemFactory()
      Constructs an unconfigured instance of this class.
      DiskFileItemFactory​(int sizeThreshold, java.io.File repository)
      Constructs a preconfigured instance of this class.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      FileItem createItem​(java.lang.String fieldName, java.lang.String contentType, boolean isFormField, java.lang.String fileName)
      Create a new DiskFileItem instance from the supplied parameters and the local factory configuration.
      java.lang.String getDefaultCharset()
      Returns the default charset for use when no explicit charset parameter is provided by the sender.
      java.io.File getRepository()
      Returns the directory used to temporarily store files that are larger than the configured size threshold.
      int getSizeThreshold()
      Returns the size threshold beyond which files are written directly to disk.
      void setDefaultCharset​(java.lang.String pCharset)
      Sets the default charset for use when no explicit charset parameter is provided by the sender.
      void setRepository​(java.io.File repository)
      Sets the directory used to temporarily store files that are larger than the configured size threshold.
      void setSizeThreshold​(int sizeThreshold)
      Sets the size threshold beyond which files are written directly to disk.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • DEFAULT_SIZE_THRESHOLD

        public static final int DEFAULT_SIZE_THRESHOLD
        The default threshold above which uploads will be stored on disk.
        See Also:
        Constant Field Values

    • Constructor Detail

      • DiskFileItemFactory

        public DiskFileItemFactory()
        Constructs an unconfigured instance of this class. The resulting factory may be configured by calling the appropriate setter methods.

      • DiskFileItemFactory

        public DiskFileItemFactory​(int sizeThreshold,
                           java.io.File repository)
        Constructs a preconfigured instance of this class.
        Parameters:
        sizeThreshold - The threshold, in bytes, below which items will be retained in memory and above which they will be stored as a file.
        repository - The data repository, which is the directory in which files will be created, should the item size exceed the threshold.

    • Method Detail

      • getRepository

        public java.io.File getRepository()
        Returns the directory used to temporarily store files that are larger than the configured size threshold.
        Returns:
        The directory in which temporary files will be located.
        See Also:
        setRepository(java.io.File)

      • setRepository

        public void setRepository​(java.io.File repository)
        Sets the directory used to temporarily store files that are larger than the configured size threshold.
        Parameters:
        repository - The directory in which temporary files will be located.
        See Also:
        getRepository()

      • getSizeThreshold

        public int getSizeThreshold()
        Returns the size threshold beyond which files are written directly to disk. The default value is 10240 bytes.
        Returns:
        The size threshold, in bytes.
        See Also:
        setSizeThreshold(int)

      • setSizeThreshold

        public void setSizeThreshold​(int sizeThreshold)
        Sets the size threshold beyond which files are written directly to disk.
        Parameters:
        sizeThreshold - The size threshold, in bytes.
        See Also:
        getSizeThreshold()

      • createItem

        public FileItem createItem​(java.lang.String fieldName,
                           java.lang.String contentType,
                           boolean isFormField,
                           java.lang.String fileName)
        Create a new DiskFileItem instance from the supplied parameters and the local factory configuration.
        Specified by:
        createItem in interface FileItemFactory
        Parameters:
        fieldName - The name of the form field.
        contentType - The content type of the form field.
        isFormField - true if this is a plain form field; false otherwise.
        fileName - The name of the uploaded file, if any, as supplied by the browser or other client.
        Returns:
        The newly created file item.

      • getDefaultCharset

        public java.lang.String getDefaultCharset()
        Returns the default charset for use when no explicit charset parameter is provided by the sender.
        Returns:
        the default charset

      • setDefaultCharset

        public void setDefaultCharset​(java.lang.String pCharset)
        Sets the default charset for use when no explicit charset parameter is provided by the sender.
        Parameters:
        pCharset - the default charset