FileUpload Design

FileUpload has two main points of interest to a user: the class org.apache.commons.fileupload.DiskFileUpload, which parses the incoming data, and the interface org.apache.commons.fileupload.FileItem, returned when the file upload data has successfully been parsed.

The class hierarchy for DiskFileUpload is shown in Figure 2-4.

Figure 2-4. DiskFileUpload class.

To use DiskFileUpload, the application needs to set a temporary path on disk to spool file data and the size threshold. It's easy to envision applications that might require several megabytes to be uploaded at a time, and by using the DiskFileUpload class with appropriate thresholds, the application will try not to overload the server.

Be Aware of Performance Impacts

The Java servlet model uses a single thread per request. If your application server is set to provide a maximum of fifty threads for handling incoming requests, fifty file uploads can starve the server for additional requests. You may want to consider isolating the file upload capability of your application from the thread pool for the rest of the application. For example, in Tomcat, you may want to define a second HTTP connector on a different port with another thread pool for handling file upload requests. This is application server-specific functionality, but be aware that file uploads are typically much longer-lived, resource-intensive operations than simply handling an ordinary page request.

More seriously, a series of file uploads could easily be used to launch a denial-of-service attack. In a production environment, make sure that only authenticated users are allowed to initiate a file upload.

The main DiskFileUpload method of interest is parseRequest(). It returns a List of FileItem objects , shown in more detail in Figure 2-5.

Figure 2-5. FileItem class.

The bulk of the methods of the FileItem interface are fairly self-explanatory. The most significant thing to be aware of is that using get() will load the entire file into memory at once, whereas getInputStream() allows for buffering and other stream operations.