Servlet文件上传下载实现方案详解与常见问题解析及高效安全操作指南

引言：Servlet文件上传下载的重要性与应用场景

在现代Web开发中，文件上传和下载功能是许多应用程序的核心组成部分。无论是用户上传头像、文档、视频，还是系统提供文件下载服务，这些功能都直接影响用户体验和系统安全性。Servlet作为Java EE规范中的核心技术，提供了强大的文件处理能力。本文将深入探讨Servlet实现文件上传和下载的完整方案，包括详细代码实现、常见问题分析以及高效安全的操作指南。

文件上传下载看似简单，但实际涉及多个技术层面：HTTP协议解析、流处理、内存管理、安全性控制等。一个不完善的实现可能导致服务器崩溃、数据泄露或用户体验极差。因此，掌握正确的实现方法和最佳实践至关重要。

本文将从基础概念开始，逐步深入到高级特性和安全防护，帮助开发者构建稳定、高效、安全的文件处理系统。我们将使用最新的Servlet 4.0规范，并结合Apache Commons FileUpload库（最常用的文件上传解决方案）进行详细说明。

一、Servlet文件上传实现方案详解

1.1 文件上传的基本原理

文件上传通常通过HTTP的POST请求完成，请求的Content-Type必须是multipart/form-data。Servlet本身在3.0版本之前不直接支持文件上传，需要依赖第三方库。从Servlet 3.0开始，提供了标准的文件上传支持，但Apache Commons FileUpload仍然是更灵活、功能更强大的选择。

关键概念：

multipart/form-data：将表单数据分割为多个部分，每部分对应一个表单项
文件大小限制：防止恶意上传占用过多服务器资源
临时存储：大文件上传时的内存优化策略

1.2 使用Apache Commons FileUpload实现上传

这是最经典且广泛使用的方案，兼容性好，功能完善。

1.2.1 环境准备

首先添加依赖（Maven）：

<dependency> <groupId>commons-fileupload</groupId> <artifactId>commons-fileupload</artifactId> <version>1.4</version> </dependency> <dependency> <groupId>commons-io</groupId> <artifactId>commons-io</artifactId> <version>2.11.0</version> </dependency>

1.2.2 完整上传Servlet实现

import org.apache.commons.fileupload.FileItem; import org.apache.commons.fileupload.disk.DiskFileItemFactory; import org.apache.commons.fileupload.servlet.ServletFileUpload; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.File; import java.io.IOException; import java.util.List; @WebServlet("/upload") public class FileUploadServlet extends HttpServlet { // 上传配置 private static final int MEMORY_THRESHOLD = 1024 * 1024 * 3; // 3MB private static final int MAX_FILE_SIZE = 1024 * 1024 * 40; // 40MB private static final int MAX_REQUEST_SIZE = 1024 * 1024 * 50; // 50MB protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // 1. 检查请求是否包含multipart数据 if (!ServletFileUpload.isMultipartContent(request)) { response.getWriter().write("Error: Form must have enctype=multipart/form-data."); return; } // 2. 配置上传参数 DiskFileItemFactory factory = new DiskFileItemFactory(); // 设置内存临界值 - 超过后将产生临时文件并存储于临时目录中 factory.setSizeThreshold(MEMORY_THRESHOLD); // 设置临时存储目录 String uploadTempDir = getServletContext().getRealPath("/") + "temp"; File tempDir = new File(uploadTempDir); if (!tempDir.exists()) { tempDir.mkdirs(); } factory.setRepository(tempDir); // 3. 创建ServletFileUpload ServletFileUpload upload = new ServletFileUpload(factory); // 设置最大文件大小 upload.setFileSizeMax(MAX_FILE_SIZE); // 设置最大请求值 (文件 + 表单数据) upload.setSizeMax(MAX_REQUEST_SIZE); // 4. 构造上传路径 String uploadPath = getServletContext().getRealPath("/") + "uploads"; File uploadDir = new File(uploadPath); if (!uploadDir.exists()) { uploadDir.mkdir(); } try { // 5. 解析请求内容 List<FileItem> formItems = upload.parseRequest(request); if (formItems != null && formItems.size() > 0) { String fileName = ""; String description = ""; for (FileItem item : formItems) { // 6. 处理表单字段 if (item.isFormField()) { String fieldName = item.getFieldName(); String value = item.getString("UTF-8"); if ("description".equals(fieldName)) { description = value; } } // 7. 处理文件字段 else { String originalFileName = new File(item.getName()).getName(); // 生成唯一文件名防止冲突 String fileExtension = originalFileName.substring(originalFileName.lastIndexOf(".")); String uniqueFileName = System.currentTimeMillis() + "_" + java.util.UUID.randomUUID().toString() + fileExtension; String filePath = uploadPath + File.separator + uniqueFileName; File storeFile = new File(filePath); // 8. 保存文件到磁盘 item.write(storeFile); fileName = uniqueFileName; // 记录上传日志（实际项目中应记录到数据库） System.out.println("文件上传成功: " + originalFileName + " -> " + uniqueFileName); } } // 9. 返回响应 response.setContentType("application/json"); response.setCharacterEncoding("UTF-8"); response.getWriter().write(String.format( "{"success":true,"message":"文件上传成功","fileName":"%s","description":"%s"}", fileName, description )); } } catch (Exception ex) { response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); response.getWriter().write("{"success":false,"message":"" + ex.getMessage() + ""}"); } } }

1.2.3 前端HTML表单示例

<!DOCTYPE html> <html> <head> <title>文件上传示例</title> <meta charset="UTF-8"> </head> <body> <h2>文件上传测试</h2> <form action="upload" method="post" enctype="multipart/form-data"> <div> <label>选择文件：</label> <input type="file" name="file" required> </div> <div> <label>文件描述：</label> <input type="text" name="description" placeholder="请输入文件描述"> </div> <div> <button type="submit">上传文件</button> </div> </form> </body> </html>

1.3 使用Servlet 3.0+原生API实现上传

Servlet 3.0提供了注解方式的文件上传支持，代码更简洁，但灵活性稍差。

1.3.1 配置web.xml（可选，用于精细控制）

<web-app> <servlet> <servlet-name>UploadServlet</servlet-name> <servlet-class>com.example.UploadServlet</servlet-class> <multipart-config> <max-file-size>41943040</max-file-size> <!-- 40MB --> <max-request-size>52428800</max-request-size> <!-- 50MB --> <file-size-threshold>3145728</file-size-threshold> <!-- 3MB --> </multipart-config> </servlet> </web-app>

1.3.2 Servlet 3.0上传代码

import javax.servlet.annotation.MultipartConfig; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.Part; import java.io.File; import java.io.IOException; @WebServlet("/upload3") @MultipartConfig( maxFileSize = 1024 * 1024 * 40, // 40MB maxRequestSize = 1024 * 1024 * 50, // 50MB fileSizeThreshold = 1024 * 1024 * 3 // 3MB ) public class Servlet3UploadServlet extends HttpServlet { protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String uploadPath = getServletContext().getRealPath("/") + "uploads"; File uploadDir = new File(uploadPath); if (!uploadDir.exists()) { uploadDir.mkdir(); } try { // 获取文件Part Part filePart = request.getPart("file"); // 从Part头获取原始文件名 String originalFileName = getFileName(filePart); // 生成唯一文件名 String fileExtension = originalFileName.substring(originalFileName.lastIndexOf(".")); String uniqueFileName = System.currentTimeMillis() + "_" + java.util.UUID.randomUUID().toString() + fileExtension; String filePath = uploadPath + File.separator + uniqueFileName; // 写入文件 filePart.write(filePath); // 获取描述信息 String description = request.getParameter("description"); response.getWriter().write("上传成功: " + uniqueFileName); } catch (Exception e) { response.getWriter().write("上传失败: " + e.getMessage()); } } // 从Part中提取文件名 private String getFileName(Part part) { String contentDisposition = part.getHeader("content-disposition"); String[] tokens = contentDisposition.split(";"); for (String token : tokens) { if (token.trim().startsWith("filename")) { return token.substring(token.indexOf("=") + 2, token.length() - 1); } } return ""; } }

1.4 两种方案对比

特性	Apache Commons FileUpload	Servlet 3.0+原生API
依赖	需要额外jar包	无需额外依赖
灵活性	高，可精细控制	中等，配置受限
内存控制	完善的临时文件机制	依赖容器实现
兼容性	支持Servlet 2.5+	仅支持Servlet 3.0+
易用性	代码稍复杂	代码简洁
社区支持	广泛使用，文档丰富	标准API，但调试困难

推荐：对于新项目，如果使用Servlet 3.0+且需求简单，可用原生API；对于复杂需求或需要兼容旧版本，强烈推荐Apache Commons FileUpload。

二、Servlet文件下载实现方案详解

2.1 文件下载的基本原理

文件下载通过HTTP GET请求触发，服务器设置正确的响应头，浏览器即可识别为下载行为。关键在于设置：

Content-Type：文件MIME类型
Content-Disposition：指示浏览器以附件形式处理
Content-Length：文件大小
Content-Transfer-Encoding：传输编码

2.2 基础下载实现

import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.io.OutputStream; import java.net.URLEncoder; @WebServlet("/download") public class FileDownloadServlet extends HttpServlet { // 文件存储根目录 private static final String FILE_BASE_PATH = "/path/to/upload/directory"; protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // 1. 获取文件名参数（必须进行安全校验） String fileName = request.getParameter("file"); // 安全检查：防止路径遍历攻击 if (fileName == null || fileName.isEmpty() || fileName.contains("..") || fileName.contains("/") || fileName.contains("\")) { response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file name"); return; } // 2. 构建完整文件路径 File file = new File(FILE_BASE_PATH, fileName); // 3. 检查文件是否存在且可读 if (!file.exists() || !file.isFile() || !file.canRead()) { response.sendError(HttpServletResponse.SC_NOT_FOUND, "File not found"); return; } // 4. 设置响应头 response.reset(); response.setContentType(getServletContext().getMimeType(fileName)); response.setContentLength((int) file.length()); // 重要：设置Content-Disposition，强制浏览器下载 String encodedFileName = URLEncoder.encode(fileName, "UTF-8").replaceAll("\+", "%20"); response.setHeader("Content-Disposition", "attachment; filename*=UTF-8''" + encodedFileName); // 5. 写入文件流 try (FileInputStream in = new FileInputStream(file); OutputStream out = response.getOutputStream()) { byte[] buffer = new byte[4096]; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); } out.flush(); } catch (IOException e) { // 记录日志，但客户端可能已关闭连接 log("下载过程中发生错误: " + e.getMessage()); } } }

2.3 高级下载功能：支持断点续传

对于大文件下载，支持断点续传可以提升用户体验和节省带宽。

import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.*; import java.net.URLEncoder; import java.util.Arrays; import java.util.List; @WebServlet("/download/resume") public class ResumeableDownloadServlet extends HttpServlet { private static final String FILE_BASE_PATH = "/path/to/upload/directory"; private static final int BUFFER_SIZE = 8192; protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String fileName = request.getParameter("file"); // 安全校验 if (!isValidFileName(fileName)) { response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file name"); return; } File file = new File(FILE_BASE_PATH, fileName); if (!file.exists() || !file.isFile()) { response.sendError(HttpServletResponse.SC_NOT_FOUND, "File not found"); return; } long fileLength = file.length(); long start = 0, end = fileLength - 1; // 6. 解析Range头部（断点续传） String rangeHeader = request.getHeader("Range"); if (rangeHeader != null && rangeHeader.startsWith("bytes=")) { String range = rangeHeader.substring(6); String[] ranges = range.split("-"); try { if (ranges.length == 1) { // bytes=1000- start = Long.parseLong(ranges[0]); } else if (ranges.length == 2) { // bytes=1000-2000 start = Long.parseLong(ranges[0]); end = Long.parseLong(ranges[1]); } } catch (NumberFormatException e) { response.sendError(HttpServletResponse.SC_REQUESTED_RANGE_NOT_SATISFIABLE); return; } if (start > end || start >= fileLength) { response.sendError(HttpServletResponse.SC_REQUESTED_RANGE_NOT_SATISFIABLE); return; } // 设置部分响应 response.setStatus(HttpServletResponse.SC_PARTIAL_CONTENT); response.setHeader("Content-Range", "bytes " + start + "-" + end + "/" + fileLength); } // 7. 设置响应头 response.setContentType(getServletContext().getMimeType(fileName)); response.setContentLength((int) (end - start + 1)); String encodedFileName = URLEncoder.encode(fileName, "UTF-8").replaceAll("\+", "%20"); response.setHeader("Content-Disposition", "attachment; filename*=UTF-8''" + encodedFileName); // 8. 发送文件内容 try (RandomAccessFile raf = new RandomAccessFile(file, "r"); OutputStream out = response.getOutputStream()) { raf.seek(start); long bytesRemaining = end - start + 1; byte[] buffer = new byte[BUFFER_SIZE]; while (bytesRemaining > 0) { int bytesRead = raf.read(buffer, 0, (int) Math.min(buffer.length, bytesRemaining)); if (bytesRead == -1) break; out.write(buffer, 0, bytesRead); bytesRemaining -= bytesRead; } out.flush(); } } private boolean isValidFileName(String fileName) { if (fileName == null || fileName.isEmpty()) return false; // 防止路径遍历 if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\")) return false; // 防止访问隐藏文件 if (fileName.startsWith(".")) return false; return true; } }

2.4 文件下载前端调用示例

<!DOCTYPE html> <html> <head> <title>文件下载示例</title> </head> <body> <h2>文件下载</h2> <!-- 方式1：直接链接（最简单） --> <p><a href="download?file=document.pdf">下载PDF文档</a></p> <!-- 方式2：JavaScript触发（可添加确认逻辑） --> <button onclick="downloadFile('report.xlsx')">下载报表</button> <!-- 方式3：批量下载 --> <button onclick="batchDownload()">批量下载</button> <script> function downloadFile(fileName) { if (confirm('确定要下载 ' + fileName + ' 吗？')) { window.location.href = 'download?file=' + encodeURIComponent(fileName); } } function batchDownload() { const files = ['file1.zip', 'file2.zip', 'file3.zip']; files.forEach((file, index) => { setTimeout(() => { window.open('download?file=' + encodeURIComponent(file)); }, index * 1000); // 间隔1秒，避免被浏览器拦截 }); } </script> </body> </html>

三、常见问题深度解析

3.1 上传问题

问题1：文件大小限制导致上传失败

现象：上传大文件时，浏览器显示连接重置或服务器返回413错误。

原因分析：

未正确配置max-file-size和max-request-size
服务器（Tomcat/Jetty）本身有请求大小限制
未处理SizeLimitExceededException

解决方案：

// 在Servlet中捕获特定异常 try { List<FileItem> items = upload.parseRequest(request); } catch (FileUploadBase.SizeLimitExceededException e) { response.setStatus(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE); response.getWriter().write("文件大小超过限制，最大允许 " + e.getPermittedSize() + " 字节"); return; } catch (FileUploadBase.FileSizeLimitExceededException e) { response.setStatus(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE); response.getWriter().write("单个文件大小超过限制"); return; } // Tomcat server.xml 配置（如果使用Tomcat） /* <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" maxPostSize="52428800" <!-- 50MB --> maxSavePostSize="52428800" /> */

问题2：中文文件名乱码

现象：上传中文文件名后，保存的文件名乱码或无法识别。

原因：浏览器和服务器编码不一致。

解决方案：

// 1. 在解析前设置编码 upload.setHeaderEncoding("UTF-8"); // 2. 文件名处理工具类 public class FileNameUtils { public static String safeFileName(String originalName) { if (originalName == null) return ""; // 处理浏览器编码的文件名（如：=?UTF-8?B?...?=） if (originalName.startsWith("=?") && originalName.endsWith("?=")) { try { originalName = decodeMimeFileName(originalName); } catch (Exception e) { // 解码失败，使用原始值 } } // 移除路径字符 String safeName = originalName.replace("\", "/"); safeName = safeName.substring(safeName.lastIndexOf("/") + 1); // 生成唯一文件名，避免中文问题 String extension = ""; int dotIndex = safeName.lastIndexOf("."); if (dotIndex > 0) { extension = safeName.substring(dotIndex); safeName = safeName.substring(0, dotIndex); } // 使用UUID + 时间戳，完全避免编码问题 return System.currentTimeMillis() + "_" + UUID.randomUUID().toString() + extension; } private static String decodeMimeFileName(String mimeFileName) throws Exception { // 简单实现，实际可使用JavaMail的MimeUtility return mimeFileName; // 简化处理 } }

问题3：临时文件清理不及时

现象：磁盘空间被占满，临时目录文件堆积。

原因：使用DiskFileItemFactory时，临时文件在请求结束后不会自动删除。

解决方案：

// 方案1：手动清理（推荐） public class FileUploadCleanupListener implements ServletContextListener { @Override public void contextInitialized(ServletContextEvent sce) { // 启动时清理旧临时文件 File tempDir = new File(sce.getServletContext().getRealPath("/") + "temp"); if (tempDir.exists()) { cleanDirectory(tempDir, 24 * 60 * 60 * 1000); // 删除24小时前的文件 } } private void cleanDirectory(File dir, long maxAge) { File[] files = dir.listFiles(); if (files != null) { long now = System.currentTimeMillis(); for (File file : files) { if (now - file.lastModified() > maxAge) { file.delete(); } } } } } // 方案2：在Servlet中清理 protected void doPost(HttpServletRequest request, HttpServletResponse response) { List<FileItem> items = null; try { items = upload.parseRequest(request); // 处理上传... } finally { // 确保临时文件被删除 if (items != null) { for (FileItem item : items) { if (!item.isFormField()) { item.delete(); // 删除临时文件 } } } } }

3.2 下载问题

问题1：中文文件名下载时乱码或显示为下划线

现象：下载中文文件名的文件时，文件名显示为”____“或乱码。

原因：不同浏览器对Content-Disposition的编码支持不同。

解决方案：

public class DownloadUtils { /** * 根据浏览器类型设置正确的文件名编码 */ public static String getBrowserFileName(HttpServletRequest request, String fileName) throws Exception { String userAgent = request.getHeader("User-Agent"); String encodedFileName = fileName; // IE浏览器（Trident内核） if (userAgent != null && (userAgent.contains("MSIE") || userAgent.contains("Trident"))) { encodedFileName = URLEncoder.encode(fileName, "UTF-8").replaceAll("\+", "%20"); } // Firefox、Chrome等现代浏览器 else { encodedFileName = new String(fileName.getBytes("UTF-8"), "ISO-8859-1"); } return encodedFileName; } /** * 设置下载响应头（兼容所有浏览器） */ public static void setDownloadHeaders(HttpServletRequest request, HttpServletResponse response, String originalFileName) throws Exception { response.reset(); response.setContentType("application/octet-stream"); // 获取浏览器类型 String userAgent = request.getHeader("User-Agent"); String encodedFileName; // UTF-8编码的文件名（现代浏览器） String utf8FileName = "UTF-8''" + URLEncoder.encode(originalFileName, "UTF-8").replaceAll("\+", "%20"); // ISO-8859-1编码的文件名（兼容旧浏览器） String isoFileName = new String(originalFileName.getBytes("UTF-8"), "ISO-8859-1"); if (userAgent != null && userAgent.contains("Safari") && !userAgent.contains("Chrome")) { // Safari特殊处理 encodedFileName = isoFileName; } else if (userAgent != null && userAgent.contains("Firefox")) { // Firefox encodedFileName = "UTF-8''" + URLEncoder.encode(originalFileName, "UTF-8").replaceAll("\+", "%20"); } else { // Chrome, Edge, IE11+ encodedFileName = "UTF-8''" + URLEncoder.encode(originalFileName, "UTF-8").replaceAll("\+", "%20"); } // 设置Content-Disposition response.setHeader("Content-Disposition", "attachment; filename=" + encodedFileName); // 添加备用头部（某些浏览器需要） response.setHeader("Content-Disposition", "attachment; filename*=UTF-8''" + URLEncoder.encode(originalFileName, "UTF-8").replaceAll("\+", "%20")); } } // 使用示例 DownloadUtils.setDownloadHeaders(request, response, "中文文件名.pdf");

问题2：下载大文件时内存溢出

现象：下载大文件（如>100MB）时，服务器内存溢出或响应缓慢。

原因：一次性将整个文件读入内存。

解决方案：使用流式传输，控制缓冲区大小。

// 正确的流式下载（已在2.2节示例中展示） // 关键点： // 1. 使用缓冲区，不要一次性读取 // 2. 及时关闭流 // 3. 使用try-with-resources // 额外优化：NIO方式（性能更好） public void downloadWithNIO(File file, HttpServletResponse response) throws IOException { response.setContentType("application/octet-stream"); response.setContentLength((int) file.length()); try (FileChannel inChannel = FileChannel.open(file.toPath(), StandardOpenOption.READ); WritableByteChannel outChannel = Channels.newChannel(response.getOutputStream())) { ByteBuffer buffer = ByteBuffer.allocate(8192); while (inChannel.read(buffer) != -1) { buffer.flip(); outChannel.write(buffer); buffer.compact(); } } }

问题3：文件下载后无法打开（文件损坏）

现象：下载的文件大小正确，但无法打开。

原因：

响应被多次写入
缓冲区未刷新
文件被其他进程占用

解决方案：

// 确保： // 1. 只写入一次文件流 // 2. 刷新缓冲区 // 3. 正确关闭所有流 // 错误示例（不要这样做）： OutputStream out = response.getOutputStream(); FileInputStream in = new FileInputStream(file); byte[] buffer = new byte[4096]; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); } // 忘记关闭流和刷新！ // 正确示例： try (FileInputStream in = new FileInputStream(file); OutputStream out = response.getOutputStream()) { byte[] buffer = new byte[4096]; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); } out.flush(); // 显式刷新 } // 自动关闭

四、高效安全操作指南

4.1 安全最佳实践

4.1.1 上传安全

1. 文件类型验证（白名单机制）

public class SecurityUtils { // 允许的扩展名白名单 private static final Set<String> ALLOWED_EXTENSIONS = new HashSet<>(Arrays.asList( ".jpg", ".jpeg", ".png", ".gif", ".bmp", // 图片 ".pdf", ".doc", ".docx", ".xls", ".xlsx", // 文档 ".txt", ".zip", ".rar" // 其他 )); // 允许的MIME类型白名单 private static final Set<String> ALLOWED_MIME_TYPES = new HashSet<>(Arrays.asList( "image/jpeg", "image/png", "image/gif", "image/bmp", "application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "text/plain", "application/zip", "application/x-rar-compressed" )); /** * 验证文件扩展名 */ public static boolean isValidExtension(String fileName) { if (fileName == null || fileName.isEmpty()) return false; int lastDot = fileName.lastIndexOf("."); if (lastDot == -1) return false; String extension = fileName.substring(lastDot).toLowerCase(); return ALLOWED_EXTENSIONS.contains(extension); } /** * 验证MIME类型（更可靠） */ public static boolean isValidMimeType(String mimeType) { return mimeType != null && ALLOWED_MIME_TYPES.contains(mimeType); } /** * 双重验证：扩展名 + MIME类型 */ public static boolean validateFile(String fileName, String mimeType) { return isValidExtension(fileName) && isValidMimeType(mimeType); } /** * 检测文件内容是否为真实类型（防止伪造扩展名） */ public static boolean validateFileContent(File file) throws IOException { try (FileInputStream fis = new FileInputStream(file)) { byte[] header = new byte[4]; if (fis.read(header) != 4) return false; // 简单的文件头检测 String hex = bytesToHex(header); // JPEG: FFD8FF if (hex.startsWith("FFD8FF")) return true; // PNG: 89504E47 if (hex.startsWith("89504E47")) return true; // PDF: 25504446 if (hex.startsWith("25504446")) return true; // ZIP: 504B0304 if (hex.startsWith("504B0304")) return true; return false; } } private static String bytesToHex(byte[] bytes) { StringBuilder sb = new StringBuilder(); for (byte b : bytes) { sb.append(String.format("%02X", b)); } return sb.toString(); } } // 在上传Servlet中使用 if (!SecurityUtils.isValidExtension(originalFileName)) { response.sendError(HttpServletResponse.SC_BAD_REQUEST, "不允许的文件类型"); return; } // 保存后进一步验证 File savedFile = new File(filePath); if (!SecurityUtils.validateFileContent(savedFile)) { savedFile.delete(); // 删除可疑文件 response.sendError(HttpServletResponse.SC_BAD_REQUEST, "文件内容与扩展名不匹配"); return; }

2. 文件大小限制（多层次）

// 1. 前端验证（提升用户体验） <input type="file" id="fileInput" onchange="validateSize(this)"> <script> function validateSize(input) { const maxSize = 40 * 1024 * 1024; // 40MB if (input.files[0] && input.files[0].size > maxSize) { alert('文件大小不能超过40MB'); input.value = ''; return false; } return true; } </script> // 2. Servlet验证（安全防线） upload.setFileSizeMax(MAX_FILE_SIZE); // Commons FileUpload // 或 @MultipartConfig(maxFileSize = ...) // Servlet 3.0 // 3. 服务器配置（最终保障） // Tomcat server.xml: maxPostSize

3. 防止文件名注入攻击

public static String sanitizeFileName(String fileName) { if (fileName == null) return ""; // 移除路径分隔符 fileName = fileName.replace("\", "/"); fileName = fileName.substring(fileName.lastIndexOf("/") + 1); // 移除危险字符 fileName = fileName.replaceAll("[^a-zA-Z0-9._-]", "_"); // 限制长度 if (fileName.length() > 255) { fileName = fileName.substring(0, 255); } return fileName; }

4. 存储位置安全

// 错误做法：存储在web根目录下 String path = getServletContext().getRealPath("/") + "uploads"; // 可能被直接访问 // 正确做法：存储在web根目录之外 // 在web.xml中配置路径 <context-param> <param-name>uploadStoragePath</param-name> <param-value>/opt/app/uploads</param-value> </context-param> // 或使用系统属性 String path = System.getProperty("app.upload.dir", "/default/path");

4.1.2 下载安全

1. 防止目录遍历攻击

// 已在2.2节展示，关键代码： if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\")) { response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file name"); return; } // 更严格的验证 public static boolean isSafeFilePath(String baseDir, String requestedPath) { try { File base = new File(baseDir).getCanonicalFile(); File requested = new File(base, requestedPath).getCanonicalFile(); return requested.getPath().startsWith(base.getPath()); } catch (IOException e) { return false; } }

2. 访问控制（权限验证）

// 在下载前检查用户权限 protected void doGet(HttpServletRequest request, HttpServletResponse response) { // 1. 用户认证 HttpSession session = request.getSession(false); if (session == null || session.getAttribute("user") == null) { response.sendError(HttpServletResponse.SC_UNAUTHORIZED); return; } // 2. 文件权限检查（示例：检查用户是否拥有该文件） String fileId = request.getParameter("fileId"); User user = (User) session.getAttribute("user"); if (!fileService.hasAccess(user.getId(), fileId)) { response.sendError(HttpServletResponse.SC_FORBIDDEN, "无权访问该文件"); return; } // 3. 获取文件路径（从数据库查询，而非直接使用参数） String fileName = fileService.getFileName(fileId); // ... 继续下载流程 }

3. 下载限速（防止带宽耗尽）

public class ThrottledDownloadServlet extends HttpServlet { private static final int MAX_BYTES_PER_SECOND = 1024 * 1024; // 1MB/s protected void doGet(HttpServletRequest request, HttpServletResponse response) { // ... 获取文件 ... try (FileInputStream in = new FileInputStream(file); OutputStream out = response.getOutputStream()) { byte[] buffer = new byte[8192]; long lastWrite = System.currentTimeMillis(); int totalBytes = 0; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); totalBytes += bytesRead; // 限速计算 long now = System.currentTimeMillis(); long elapsed = now - lastWrite; if (elapsed > 0) { double currentRate = (totalBytes * 1000.0) / elapsed; if (currentRate > MAX_BYTES_PER_SECOND) { // 速度过快，休眠 long sleepTime = (long) ((totalBytes * 1000.0 / MAX_BYTES_PER_SECOND) - elapsed); if (sleepTime > 0) { Thread.sleep(sleepTime); } } } } } catch (Exception e) { log.error("下载限速异常", e); } } }

4.2 性能优化

4.2.1 上传优化

1. 异步上传（提升用户体验）

// Servlet端（支持异步） @WebServlet(urlPatterns = "/asyncUpload", asyncSupported = true) public class AsyncUploadServlet extends HttpServlet { protected void doPost(HttpServletRequest request, HttpServletResponse response) { AsyncContext asyncContext = request.startAsync(); asyncContext.setTimeout(300000); // 5分钟 // 在独立线程中处理 CompletableFuture.runAsync(() -> { try { // 处理上传逻辑 processUpload(asyncContext.getRequest(), asyncContext.getResponse()); asyncContext.complete(); } catch (Exception e) { asyncContext.complete(); } }); } } // 前端（使用Fetch API + 进度条） async function uploadFile(file) { const formData = new FormData(); formData.append('file', file); const response = await fetch('asyncUpload', { method: 'POST', body: formData, // 注意：Fetch API目前不支持上传进度，需使用XMLHttpRequest }); return await response.json(); } // 使用XMLHttpRequest获取进度 function uploadWithProgress(file) { const xhr = new XMLHttpRequest(); const formData = new FormData(); formData.append('file', file); xhr.upload.addEventListener('progress', (e) => { if (e.lengthComputable) { const percent = (e.loaded / e.total) * 100; console.log(`上传进度: ${percent.toFixed(2)}%`); updateProgressBar(percent); } }); xhr.open('POST', 'upload'); xhr.send(formData); }

2. 分片上传（超大文件）

// 分片上传Servlet @WebServlet("/upload/chunk") public class ChunkUploadServlet extends HttpServlet { private static final String CHUNK_DIR = "/path/to/chunks"; protected void doPost(HttpServletRequest request, HttpServletResponse response) { String fileId = request.getParameter("fileId"); int chunkIndex = Integer.parseInt(request.getParameter("chunkIndex")); int totalChunks = Integer.parseInt(request.getParameter("totalChunks")); // 保存分片 File chunkFile = new File(CHUNK_DIR, fileId + ".part" + chunkIndex); try (InputStream in = request.getInputStream(); FileOutputStream out = new FileOutputStream(chunkFile)) { byte[] buffer = new byte[8192]; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); } } // 检查是否所有分片都上传完成 if (isAllChunksUploaded(fileId, totalChunks)) { // 合并分片 mergeChunks(fileId, totalChunks); } response.getWriter().write("{"success":true}"); } private boolean isAllChunksUploaded(String fileId, int totalChunks) { for (int i = 0; i < totalChunks; i++) { if (!new File(CHUNK_DIR, fileId + ".part" + i).exists()) { return false; } } return true; } private void mergeChunks(String fileId, int totalChunks) throws IOException { File finalFile = new File("/path/to/final", fileId); try (FileOutputStream out = new FileOutputStream(finalFile)) { for (int i = 0; i < totalChunks; i++) { File chunk = new File(CHUNK_DIR, fileId + ".part" + i); try (FileInputStream in = new FileInputStream(chunk)) { byte[] buffer = new byte[8192]; int bytesRead; while ((bytesRead = in.read(buffer)) != -1) { out.write(buffer, 0, bytesRead); } } chunk.delete(); // 删除临时分片 } } } }

4.2.2 下载优化

1. 使用CDN加速

// 对于静态文件，生成CDN链接而非直接下载 public String getCdnDownloadUrl(String fileKey) { // 生成带签名的CDN URL（如阿里云OSS、AWS S3） // 例如：https://your-bucket.oss-cn-hangzhou.aliyuncs.com/file.pdf?Signature=... return cdnService.generateSignedUrl(fileKey, 3600); // 1小时有效 } // 前端直接跳转CDN链接 window.location.href = getCdnDownloadUrl('document.pdf');

2. 文件预压缩

// 对于文本文件，预先压缩存储 public void compressAndStore(File originalFile) throws IOException { File compressedFile = new File(originalFile.getParent(), originalFile.getName() + ".gz"); try (FileInputStream fis = new FileInputStream(originalFile); FileOutputStream fos = new FileOutputStream(compressedFile); GZIPOutputStream gzos = new GZIPOutputStream(fos)) { byte[] buffer = new byte[8192]; int bytesRead; while ((bytesRead = fis.read(buffer)) != -1) { gzos.write(buffer, 0, bytesRead); } } } // 下载时根据客户端支持选择 protected void doGet(HttpServletRequest request, HttpServletResponse response) { String acceptEncoding = request.getHeader("Accept-Encoding"); boolean supportsGzip = acceptEncoding != null && acceptEncoding.contains("gzip"); File file = supportsGzip ? new File(filePath + ".gz") : new File(filePath); if (supportsGzip) { response.setHeader("Content-Encoding", "gzip"); } // ... 继续下载流程 }

4.3 监控与日志

4.3.1 详细日志记录

import org.slf4j.Logger; import org.slf4j.LoggerFactory; public class MonitoredFileUploadServlet extends HttpServlet { private static final Logger logger = LoggerFactory.getLogger(MonitoredFileUploadServlet.class); protected void doPost(HttpServletRequest request, HttpServletResponse response) { String clientIP = request.getRemoteAddr(); String userAgent = request.getHeader("User-Agent"); long startTime = System.currentTimeMillis(); try { // 处理上传... long duration = System.currentTimeMillis() - startTime; logger.info("UPLOAD_SUCCESS: ip={}, file={}, size={}, duration={}ms, user={}", clientIP, fileName, fileSize, duration, getUserId(request)); } catch (Exception e) { long duration = System.currentTimeMillis() - startTime; logger.error("UPLOAD_FAILED: ip={}, duration={}ms, error={}", clientIP, duration, e.getMessage(), e); response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); } } }

4.3.2 性能监控

// 使用MBean监控上传统计 public class UploadMonitor implements UploadMonitorMBean { private final AtomicLong uploadCount = new AtomicLong(0); private final AtomicLong totalBytes = new AtomicLong(0); private final AtomicLong failedCount = new AtomicLong(0); @Override public long getUploadCount() { return uploadCount.get(); } @Override public long getTotalBytes() { return totalBytes.get(); } @Override public long getFailedCount() { return failedCount.get(); } @Override public double getAverageSize() { long count = uploadCount.get(); return count > 0 ? (double) totalBytes.get() / count : 0; } public void recordSuccess(long bytes) { uploadCount.incrementAndGet(); totalBytes.addAndGet(bytes); } public void recordFailure() { failedCount.incrementAndGet(); } // 注册MBean public static void register() throws Exception { MBeanServer mbs = ManagementFactory.getPlatformMBeanServer(); ObjectName name = new ObjectName("com.example:type=UploadMonitor"); UploadMonitor monitor = new UploadMonitor(); mbs.registerMBean(monitor, name); } }

五、完整项目结构示例

5.1 推荐目录结构

src/main/java/ └── com/example/ ├── servlet/ │ ├── FileUploadServlet.java │ ├── FileDownloadServlet.java │ └── AsyncUploadServlet.java ├── service/ │ ├── FileService.java │ └── SecurityService.java ├── util/ │ ├── FileNameUtils.java │ ├── SecurityUtils.java │ └── DownloadUtils.java ├── model/ │ └── FileMeta.java └── listener/ └── FileCleanupListener.java src/main/webapp/ ├── WEB-INF/ │ ├── web.xml │ └── classes/ ├── uploads/ # 实际不推荐放在webapp下 ├── temp/ # 临时目录 └── index.jsp # 上传下载页面 src/main/resources/ └── file-config.properties

5.2 web.xml配置示例

<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0"> <!-- 文件存储路径配置 --> <context-param> <param-name>uploadStoragePath</param-name> <param-value>/opt/app/uploads</param-value> </context-param> <!-- 临时目录配置 --> <context-param> <param-name>uploadTempPath</param-name> <param-value>/opt/app/temp</param-value> </context-param> <!-- 文件大小限制 --> <context-param> <param-name>maxFileSize</param-name> <param-value>41943040</param-value> <!-- 40MB --> </context-param> <!-- 监听器：启动时初始化和清理 --> <listener> <listener-class>com.example.listener.FileCleanupListener</listener-class> </listener> <!-- 上传Servlet --> <servlet> <servlet-name>FileUploadServlet</servlet-name> <servlet-class>com.example.servlet.FileUploadServlet</servlet-class> <multipart-config> <max-file-size>41943040</max-file-size> <max-request-size>52428800</max-request-size> <file-size-threshold>3145728</file-size-threshold> </multipart-config> </servlet> <servlet-mapping> <servlet-name>FileUploadServlet</servlet-name> <url-pattern>/upload</url-pattern> </servlet-mapping> <!-- 下载Servlet --> <servlet> <servlet-name>FileDownloadServlet</servlet-name> <servlet-class>com.example.servlet.FileDownloadServlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>FileDownloadServlet</servlet-name> <url-pattern>/download</url-pattern> </servlet-mapping> <!-- 错误页面配置 --> <error-page> <error-code>404</error-code> <location>/error/404.jsp</location> </error-page> <error-page> <error-code>500</error-code> <location>/error/500.jsp</location> </error-page> </web-app>

5.3 完整配置类示例

import javax.servlet.ServletContext; import java.io.IOException; import java.io.InputStream; import java.util.Properties; public class FileConfig { private static final Properties props = new Properties(); static { try (InputStream in = FileConfig.class.getClassLoader() .getResourceAsStream("file-config.properties")) { if (in != null) { props.load(in); } } catch (IOException e) { throw new RuntimeException("无法加载文件配置", e); } } public static String getUploadPath(ServletContext context) { // 优先使用context参数，其次配置文件，最后默认值 String path = context.getInitParameter("uploadStoragePath"); if (path == null) { path = props.getProperty("upload.path", "/opt/app/uploads"); } return path; } public static long getMaxFileSize() { String size = props.getProperty("max.file.size", "41943040"); return Long.parseLong(size); } public static boolean isProduction() { return "production".equals(props.getProperty("env", "development")); } }