Tomcat 7 by Dissection: How CGI File Upload Works

I wonder which old Tomcat version our application based its CGIServlet class on. CGI HTTP POST was not working, and recently another problem has cropped up – CGI File Upload does not work. What gives? I can only speculate.

The original codes may have been taken from a development branch,
Tomcat CGI was, by then, an afterthought, incomplete, and kept dormant as a module,
Or the functions were omitted in the early derivatives, early versions of our application.

Whatever. The fact of the matter is that there is a ticket assigned to me. So, how should the codes be modified to make the file upload work? The solution is to write out the bytes from the HttpServletRequest InputStream object onto the Process object’s OutputStream when the content length is more significant than zero. It figures, right?

In Tomcat 7, the functionality is coded in CGIServlet class as follows:

// CGIRunner class within CGIServlet class
protected void run() throws IOException {
    try {
        rt = Runtime.getRuntime();
        proc = rt.exec(
        cmdAndArgs.toArray(
        new String[cmdAndArgs.size()]),
        hashToStringArray(env), wd);

        String sContentLength = env.get("CONTENT_LENGTH");

        if(!"".equals(sContentLength)) {
            commandsStdIn = new BufferedOutputStream(
            proc.getOutputStream());
            IOTools.flow(stdin, commandsStdIn);
            commandsStdIn.flush();
            commandsStdIn.close();
        }
 ....

// CGIRunner class within CGIServlet class

protected void run() throws IOException {

try {

rt = Runtime.getRuntime();

proc = rt.exec(

cmdAndArgs.toArray(

new String[cmdAndArgs.size()]),

hashToStringArray(env), wd);

String sContentLength = env.get("CONTENT_LENGTH");

if(!"".equals(sContentLength)) {

commandsStdIn = new BufferedOutputStream(

proc.getOutputStream());

IOTools.flow(stdin, commandsStdIn);

commandsStdIn.flush();

commandsStdIn.close();

}

....

Here is a sample CGI script to play around with TC7’s CGI File Upload function:

#!/usr/bin/perl
use strict;
use CGI;
use CGI::Carp qw ( fatalsToBrowser );
use File::Basename;

$CGI::POST_MAX = 1024 * 5000;
my $safe_filename_characters = "a-zA-Z0-9_.-";
my $upload_dir = "/root/Desktop/upload";
my $query = new CGI;
my $filename = $query->param("photo");
my $email_address = $query->param("email_address");

if ( !$filename )
{
  print $query->header ( );
  print "There was a problem uploading your photo (try a smaller file).";
  exit;
}

my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );
$filename = $name . $extension;
$filename =~ tr/ /_/;
$filename =~ s/[^$safe_filename_characters]//g;

if ( $filename =~ /^([$safe_filename_characters]+)$/ )
{
  $filename = $1;
}
else
{
  die "Filename contains invalid characters";
}

my $upload_filehandle = $query->upload("photo");
open ( UPLOADFILE, ">$upload_dir/$filename" ) or die "$!";

binmode UPLOADFILE;

while ( <$upload_filehandle> )
{
  print UPLOADFILE;
}

close UPLOADFILE;
print $query->header ( );
print <<END_HTML;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>Thanks!</title>
  <style type="text/css">
    img {border: none;}
  </style>
</head>
<body>
  <p>Thanks for uploading your photo!</p>
  <p>Your email address: $email_address</p>
  <p>Your photo:</p>
  <p>
    <img src="/upload/$filename" alt="Photo" />
  </p>
</body>
</html>
END_HTML

#!/usr/bin/perl

use strict;

use CGI;

use CGI::Carp qw ( fatalsToBrowser );

use File::Basename;

$CGI::POST_MAX = 1024 * 5000;

my $safe_filename_characters = "a-zA-Z0-9_.-";

my $upload_dir = "/root/Desktop/upload";

my $query = new CGI;

my $filename = $query->param("photo");

my $email_address = $query->param("email_address");

if ( !$filename )

{

print $query->header ( );

print "There was a problem uploading your photo (try a smaller file).";

exit;

}

my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );

$filename = $name . $extension;

$filename =~ tr/ /_/;

$filename =~ s/[^$safe_filename_characters]//g;

if ( $filename =~ /^([$safe_filename_characters]+)$/ )

{

$filename = $1;

}

else

{

die "Filename contains invalid characters";

}

my $upload_filehandle = $query->upload("photo");

open ( UPLOADFILE, ">$upload_dir/$filename" ) or die "$!";

binmode UPLOADFILE;

while ( <$upload_filehandle> )

{

print UPLOADFILE;

}

close UPLOADFILE;

print $query->header ( );

print <<END_HTML;

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">

<head>

<title>Thanks!</title>

img {border: none;}

</style>

</head>

<body>

<p>Thanks for uploading your photo!</p>

<p>Your email address: $email_address</p>

<p>Your photo:</p>

<p>

</p>

</body>

</html>

END_HTML

TC7 Rev 1097024

Related Articles

You Might Also Like

Search the site