Tomcat 7 by Dissection: How CGI File Upload Works

NOTE: “Tomcat 7 by Dissection” is a collection of blogs pinpointing, and detailing some Tomcat 7 functionalities on code level . The blogs are meant as code “footprints” for the author.

I wonder which ancient Tomcat version our application based its CGIServlet class on. CGI HTTP POST was not working and recently another problem has cropped up – CGI File Upload does not work at all. What gives? I can only speculate.

The original codes may have been taken from a development branch,
Tomcat CGI was, by then, an afterthought, incomplete, and kept dormant as a module,
Or the functions were omitted in the early derivatives, early versions of our application.

Whatever. The fact of the matter is that there is a ticket and it is assigned to me. So, how should the codes be modified to make the file upload work? The solution is to write out the bytes from the HttpServletRequest InputStream object onto the Process object’s OutputStream when the content length is greater than zero. It figures, right?

In Tomcat 7, the functionality is coded in CGIServlet class as follows:

// CGIRunner class within CGIServlet class
protected void run() throws IOException {
    try {
        rt = Runtime.getRuntime();
        proc = rt.exec(
        cmdAndArgs.toArray(
        new String[cmdAndArgs.size()]),
        hashToStringArray(env), wd);

        String sContentLength = env.get("CONTENT_LENGTH");

        if(!"".equals(sContentLength)) {
            commandsStdIn = new BufferedOutputStream(
            proc.getOutputStream());
            IOTools.flow(stdin, commandsStdIn);
            commandsStdIn.flush();
            commandsStdIn.close();
        }
 ....

// CGIRunner class within CGIServlet class

protected void run() throws IOException {

try {

rt = Runtime.getRuntime();

proc = rt.exec(

cmdAndArgs.toArray(

new String[cmdAndArgs.size()]),

hashToStringArray(env), wd);

String sContentLength = env.get("CONTENT_LENGTH");

if(!"".equals(sContentLength)) {

commandsStdIn = new BufferedOutputStream(

proc.getOutputStream());

IOTools.flow(stdin, commandsStdIn);

commandsStdIn.flush();

commandsStdIn.close();

}

....

Here is a sample CGI script to play around with TC7’s CGI File Upload function:

#!/usr/bin/perl
use strict;
use CGI;
use CGI::Carp qw ( fatalsToBrowser );
use File::Basename;

$CGI::POST_MAX = 1024 * 5000;
my $safe_filename_characters = "a-zA-Z0-9_.-";
my $upload_dir = "/root/Desktop/upload";
my $query = new CGI;
my $filename = $query->param("photo");
my $email_address = $query->param("email_address");

if ( !$filename )
{
  print $query->header ( );
  print "There was a problem uploading your photo (try a smaller file).";
  exit;
}

my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );
$filename = $name . $extension;
$filename =~ tr/ /_/;
$filename =~ s/[^$safe_filename_characters]//g;

if ( $filename =~ /^([$safe_filename_characters]+)$/ )
{
  $filename = $1;
}
else
{
  die "Filename contains invalid characters";
}

my $upload_filehandle = $query->upload("photo");
open ( UPLOADFILE, ">$upload_dir/$filename" ) or die "$!";

binmode UPLOADFILE;

while ( <$upload_filehandle> )
{
  print UPLOADFILE;
}

close UPLOADFILE;
print $query->header ( );
print <<END_HTML;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>Thanks!</title>
  <style type="text/css">
    img {border: none;}
  </style>
</head>
<body>
  <p>Thanks for uploading your photo!</p>
  <p>Your email address: $email_address</p>
  <p>Your photo:</p>
  <p>
    <img src="/upload/$filename" alt="Photo" />
  </p>
</body>
</html>
END_HTML

#!/usr/bin/perl

use strict;

use CGI;

use CGI::Carp qw ( fatalsToBrowser );

use File::Basename;

$CGI::POST_MAX = 1024 * 5000;

my $safe_filename_characters = "a-zA-Z0-9_.-";

my $upload_dir = "/root/Desktop/upload";

my $query = new CGI;

my $filename = $query->param("photo");

my $email_address = $query->param("email_address");

if ( !$filename )

{

print $query->header ( );

print "There was a problem uploading your photo (try a smaller file).";

exit;

}

my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );

$filename = $name . $extension;

$filename =~ tr/ /_/;

$filename =~ s/[^$safe_filename_characters]//g;

if ( $filename =~ /^([$safe_filename_characters]+)$/ )

{

$filename = $1;

}

else

{

die "Filename contains invalid characters";

}

my $upload_filehandle = $query->upload("photo");

open ( UPLOADFILE, ">$upload_dir/$filename" ) or die "$!";

binmode UPLOADFILE;

while ( <$upload_filehandle> )

{

print UPLOADFILE;

}

close UPLOADFILE;

print $query->header ( );

print <<END_HTML;

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">

<head>

<title>Thanks!</title>

img {border: none;}

</style>

</head>

<body>

<p>Thanks for uploading your photo!</p>

<p>Your email address: $email_address</p>

<p>Your photo:</p>

<p>

</p>

</body>

</html>

END_HTML

TC7 Rev 1097024

By Karl San Gabriel

Related Articles

You Might Also Like

Flyweight Design Pattern in Java

How to fix “Warning: Invalid argument supplied for foreach()” in PHP

Java – Get a directory’s size

Swap Between Vec Elements in Rust

Search the site