2 // ========================================================================
3 // Copyright (c) 1995-2014 Mort Bay Consulting Pty. Ltd.
4 // ------------------------------------------------------------------------
5 // All rights reserved. This program and the accompanying materials
6 // are made available under the terms of the Eclipse Public License v1.0
7 // and Apache License v2.0 which accompanies this distribution.
9 // The Eclipse Public License is available at
10 // http://www.eclipse.org/legal/epl-v10.html
12 // The Apache License v2.0 is available at
13 // http://www.opensource.org/licenses/apache2.0.php
15 // You may elect to redistribute this code under either of these licenses.
16 // ========================================================================
19 package org.eclipse.jetty.util;
21 import java.io.BufferedInputStream;
22 import java.io.BufferedOutputStream;
23 import java.io.ByteArrayInputStream;
24 import java.io.ByteArrayOutputStream;
26 import java.io.FileInputStream;
27 import java.io.FileOutputStream;
28 import java.io.FilterInputStream;
29 import java.io.IOException;
30 import java.io.InputStream;
31 import java.io.OutputStream;
32 import java.nio.charset.StandardCharsets;
33 import java.util.ArrayList;
34 import java.util.Collection;
35 import java.util.Collections;
36 import java.util.List;
37 import java.util.Locale;
39 import javax.servlet.MultipartConfigElement;
40 import javax.servlet.ServletException;
41 import javax.servlet.http.Part;
43 import org.eclipse.jetty.util.log.Log;
44 import org.eclipse.jetty.util.log.Logger;
49 * MultiPartInputStream
51 * Handle a MultiPart Mime input stream, breaking it up on the boundary into files and strings.
53 public class MultiPartInputStreamParser
55 private static final Logger LOG = Log.getLogger(MultiPartInputStreamParser.class);
56 public static final MultipartConfigElement __DEFAULT_MULTIPART_CONFIG = new MultipartConfigElement(System.getProperty("java.io.tmpdir"));
57 protected InputStream _in;
58 protected MultipartConfigElement _config;
59 protected String _contentType;
60 protected MultiMap _parts;
61 protected File _tmpDir;
62 protected File _contextTmpDir;
63 protected boolean _deleteOnExit;
67 public class MultiPart implements Part
69 protected String _name;
70 protected String _filename;
72 protected OutputStream _out;
73 protected ByteArrayOutputStream2 _bout;
74 protected String _contentType;
75 protected MultiMap _headers;
76 protected long _size = 0;
77 protected boolean _temporary = true;
79 public MultiPart (String name, String filename)
86 protected void setContentType (String contentType)
88 _contentType = contentType;
95 //We will either be writing to a file, if it has a filename on the content-disposition
96 //and otherwise a byte-array-input-stream, OR if we exceed the getFileSizeThreshold, we
97 //will need to change to write to a file.
98 if (_filename != null && _filename.trim().length() > 0)
104 //Write to a buffer in memory until we discover we've exceed the
105 //MultipartConfig fileSizeThreshold
106 _out = _bout= new ByteArrayOutputStream2();
110 protected void close()
117 protected void write (int b)
120 if (MultiPartInputStreamParser.this._config.getMaxFileSize() > 0 && _size + 1 > MultiPartInputStreamParser.this._config.getMaxFileSize())
121 throw new IllegalStateException ("Multipart Mime part "+_name+" exceeds max filesize");
123 if (MultiPartInputStreamParser.this._config.getFileSizeThreshold() > 0 && _size + 1 > MultiPartInputStreamParser.this._config.getFileSizeThreshold() && _file==null)
129 protected void write (byte[] bytes, int offset, int length)
132 if (MultiPartInputStreamParser.this._config.getMaxFileSize() > 0 && _size + length > MultiPartInputStreamParser.this._config.getMaxFileSize())
133 throw new IllegalStateException ("Multipart Mime part "+_name+" exceeds max filesize");
135 if (MultiPartInputStreamParser.this._config.getFileSizeThreshold() > 0 && _size + length > MultiPartInputStreamParser.this._config.getFileSizeThreshold() && _file==null)
138 _out.write(bytes, offset, length);
142 protected void createFile ()
145 _file = File.createTempFile("MultiPart", "", MultiPartInputStreamParser.this._tmpDir);
147 _file.deleteOnExit();
148 FileOutputStream fos = new FileOutputStream(_file);
149 BufferedOutputStream bos = new BufferedOutputStream(fos);
151 if (_size > 0 && _out != null)
153 //already written some bytes, so need to copy them into the file
164 protected void setHeaders(MultiMap headers)
170 * @see javax.servlet.http.Part#getContentType()
172 public String getContentType()
178 * @see javax.servlet.http.Part#getHeader(java.lang.String)
180 public String getHeader(String name)
184 return (String)_headers.getValue(name.toLowerCase(Locale.ENGLISH), 0);
188 * @see javax.servlet.http.Part#getHeaderNames()
190 public Collection<String> getHeaderNames()
192 return _headers.keySet();
196 * @see javax.servlet.http.Part#getHeaders(java.lang.String)
198 public Collection<String> getHeaders(String name)
200 return _headers.getValues(name);
204 * @see javax.servlet.http.Part#getInputStream()
206 public InputStream getInputStream() throws IOException
210 //written to a file, whether temporary or not
211 return new BufferedInputStream (new FileInputStream(_file));
215 //part content is in memory
216 return new ByteArrayInputStream(_bout.getBuf(),0,_bout.size());
222 * @see javax.servlet.http.Part#getSubmittedFileName()
225 public String getSubmittedFileName()
227 return getContentDispositionFilename();
230 public byte[] getBytes()
233 return _bout.toByteArray();
238 * @see javax.servlet.http.Part#getName()
240 public String getName()
246 * @see javax.servlet.http.Part#getSize()
248 public long getSize()
254 * @see javax.servlet.http.Part#write(java.lang.String)
256 public void write(String fileName) throws IOException
262 //part data is only in the ByteArrayOutputStream and never been written to disk
263 _file = new File (_tmpDir, fileName);
265 BufferedOutputStream bos = null;
268 bos = new BufferedOutputStream(new FileOutputStream(_file));
281 //the part data is already written to a temporary file, just rename it
284 File f = new File(_tmpDir, fileName);
285 if (_file.renameTo(f))
291 * Remove the file, whether or not Part.write() was called on it
292 * (ie no longer temporary)
293 * @see javax.servlet.http.Part#delete()
295 public void delete() throws IOException
297 if (_file != null && _file.exists())
302 * Only remove tmp files.
304 * @throws IOException
306 public void cleanUp() throws IOException
308 if (_temporary && _file != null && _file.exists())
314 * Get the file, if any, the data has been written to.
316 public File getFile ()
323 * Get the filename from the content-disposition.
324 * @return null or the filename
326 public String getContentDispositionFilename ()
336 * @param in Request input stream
337 * @param contentType Content-Type header
338 * @param config MultipartConfigElement
339 * @param contextTmpDir javax.servlet.context.tempdir
341 public MultiPartInputStreamParser (InputStream in, String contentType, MultipartConfigElement config, File contextTmpDir)
343 _in = new ReadLineInputStream(in);
344 _contentType = contentType;
346 _contextTmpDir = contextTmpDir;
347 if (_contextTmpDir == null)
348 _contextTmpDir = new File (System.getProperty("java.io.tmpdir"));
351 _config = new MultipartConfigElement(_contextTmpDir.getAbsolutePath());
355 * Get the already parsed parts.
357 public Collection<Part> getParsedParts()
360 return Collections.emptyList();
362 Collection<Object> values = _parts.values();
363 List<Part> parts = new ArrayList<Part>();
364 for (Object o: values)
366 List<Part> asList = LazyList.getList(o, false);
367 parts.addAll(asList);
373 * Delete any tmp storage for parts, and clear out the parts list.
375 * @throws MultiException
377 public void deleteParts ()
378 throws MultiException
380 Collection<Part> parts = getParsedParts();
381 MultiException err = new MultiException();
386 ((MultiPartInputStreamParser.MultiPart)p).cleanUp();
395 err.ifExceptionThrowMulti();
400 * Parse, if necessary, the multipart data and return the list of Parts.
402 * @throws IOException
403 * @throws ServletException
405 public Collection<Part> getParts()
406 throws IOException, ServletException
409 Collection<Object> values = _parts.values();
410 List<Part> parts = new ArrayList<Part>();
411 for (Object o: values)
413 List<Part> asList = LazyList.getList(o, false);
414 parts.addAll(asList);
421 * Get the named Part.
424 * @throws IOException
425 * @throws ServletException
427 public Part getPart(String name)
428 throws IOException, ServletException
431 return (Part)_parts.getValue(name, 0);
436 * Parse, if necessary, the multipart stream.
438 * @throws IOException
439 * @throws ServletException
441 protected void parse ()
442 throws IOException, ServletException
444 //have we already parsed the input?
449 long total = 0; //keep running total of size of bytes read from input and throw an exception if exceeds MultipartConfigElement._maxRequestSize
450 _parts = new MultiMap();
452 //if its not a multipart request, don't parse it
453 if (_contentType == null || !_contentType.startsWith("multipart/form-data"))
456 //sort out the location to which to write the files
458 if (_config.getLocation() == null)
459 _tmpDir = _contextTmpDir;
460 else if ("".equals(_config.getLocation()))
461 _tmpDir = _contextTmpDir;
464 File f = new File (_config.getLocation());
468 _tmpDir = new File (_contextTmpDir, _config.getLocation());
471 if (!_tmpDir.exists())
474 String contentTypeBoundary = "";
475 int bstart = _contentType.indexOf("boundary=");
478 int bend = _contentType.indexOf(";", bstart);
479 bend = (bend < 0? _contentType.length(): bend);
480 contentTypeBoundary = QuotedStringTokenizer.unquote(value(_contentType.substring(bstart,bend)).trim());
483 String boundary="--"+contentTypeBoundary;
484 byte[] byteBoundary=(boundary+"--").getBytes(StandardCharsets.ISO_8859_1);
486 // Get first boundary
490 line=((ReadLineInputStream)_in).readLine();
492 catch (IOException e)
494 LOG.warn("Badly formatted multipart request");
499 throw new IOException("Missing content for multipart request");
501 boolean badFormatLogged = false;
503 while (line != null && !line.equals(boundary))
505 if (!badFormatLogged)
507 LOG.warn("Badly formatted multipart request");
508 badFormatLogged = true;
510 line=((ReadLineInputStream)_in).readLine();
511 line=(line==null?line:line.trim());
515 throw new IOException("Missing initial multi part boundary");
518 boolean lastPart=false;
520 outer:while(!lastPart)
522 String contentDisposition=null;
523 String contentType=null;
524 String contentTransferEncoding=null;
526 MultiMap headers = new MultiMap();
529 line=((ReadLineInputStream)_in).readLine();
539 total += line.length();
540 if (_config.getMaxRequestSize() > 0 && total > _config.getMaxRequestSize())
541 throw new IllegalStateException ("Request exceeds maxRequestSize ("+_config.getMaxRequestSize()+")");
543 //get content-disposition and content-type
544 int c=line.indexOf(':',0);
547 String key=line.substring(0,c).trim().toLowerCase(Locale.ENGLISH);
548 String value=line.substring(c+1,line.length()).trim();
549 headers.put(key, value);
550 if (key.equalsIgnoreCase("content-disposition"))
551 contentDisposition=value;
552 if (key.equalsIgnoreCase("content-type"))
554 if(key.equals("content-transfer-encoding"))
555 contentTransferEncoding=value;
559 // Extract content-disposition
560 boolean form_data=false;
561 if(contentDisposition==null)
563 throw new IOException("Missing content-disposition");
566 QuotedStringTokenizer tok=new QuotedStringTokenizer(contentDisposition,";", false, true);
568 String filename=null;
569 while(tok.hasMoreTokens())
571 String t=tok.nextToken().trim();
572 String tl=t.toLowerCase(Locale.ENGLISH);
573 if(t.startsWith("form-data"))
575 else if(tl.startsWith("name="))
577 else if(tl.startsWith("filename="))
578 filename=filenameValue(t);
586 //It is valid for reset and submit buttons to have an empty name.
587 //If no name is supplied, the browser skips sending the info for that field.
588 //However, if you supply the empty string as the name, the browser sends the
589 //field, with name as the empty string. So, only continue this loop if we
590 //have not yet seen a name field.
597 MultiPart part = new MultiPart(name, filename);
598 part.setHeaders(headers);
599 part.setContentType(contentType);
600 _parts.add(name, part);
603 InputStream partInput = null;
604 if ("base64".equalsIgnoreCase(contentTransferEncoding))
606 partInput = new Base64InputStream((ReadLineInputStream)_in);
608 else if ("quoted-printable".equalsIgnoreCase(contentTransferEncoding))
610 partInput = new FilterInputStream(_in)
613 public int read() throws IOException
616 if (c >= 0 && c == '=')
620 if (hi < 0 || lo < 0)
622 throw new IOException("Unexpected end to quoted-printable byte");
624 char[] chars = new char[] { (char)hi, (char)lo };
625 c = Integer.parseInt(new String(chars),16);
642 // loop for all lines
646 while((c=(state!=-2)?state:partInput.read())!=-1)
649 if (_config.getMaxRequestSize() > 0 && total > _config.getMaxRequestSize())
650 throw new IllegalStateException("Request exceeds maxRequestSize ("+_config.getMaxRequestSize()+")");
654 // look for CR and/or LF
660 int tmp=partInput.read();
670 if(b>=0&&b<byteBoundary.length&&c==byteBoundary[b])
676 // Got a character not part of the boundary, so we don't have the boundary marker.
677 // Write out as many chars as we matched, then the char we're looking at.
686 part.write(byteBoundary,0,b);
693 // Check for incomplete boundary match, writing out the chars we matched along the way
694 if((b>0&&b<byteBoundary.length-2)||(b==byteBoundary.length-1))
703 part.write(byteBoundary,0,b);
707 // Boundary match. If we've run out of input or we matched the entire final boundary marker, then this is the last part.
711 if(b==byteBoundary.length)
726 lf=(c==10||state==10);
738 throw new IOException("Incomplete parts");
741 public void setDeleteOnExit(boolean deleteOnExit)
743 _deleteOnExit = deleteOnExit;
747 public boolean isDeleteOnExit()
749 return _deleteOnExit;
753 /* ------------------------------------------------------------ */
754 private String value(String nameEqualsValue)
756 int idx = nameEqualsValue.indexOf('=');
757 String value = nameEqualsValue.substring(idx+1).trim();
758 return QuotedStringTokenizer.unquoteOnly(value);
762 /* ------------------------------------------------------------ */
763 private String filenameValue(String nameEqualsValue)
765 int idx = nameEqualsValue.indexOf('=');
766 String value = nameEqualsValue.substring(idx+1).trim();
768 if (value.matches(".??[a-z,A-Z]\\:\\\\[^\\\\].*"))
770 //incorrectly escaped IE filenames that have the whole path
771 //we just strip any leading & trailing quotes and leave it as is
772 char first=value.charAt(0);
773 if (first=='"' || first=='\'')
774 value=value.substring(1);
775 char last=value.charAt(value.length()-1);
776 if (last=='"' || last=='\'')
777 value = value.substring(0,value.length()-1);
782 //unquote the string, but allow any backslashes that don't
783 //form a valid escape sequence to remain as many browsers
784 //even on *nix systems will not escape a filename containing
786 return QuotedStringTokenizer.unquoteOnly(value, true);
791 private static class Base64InputStream extends InputStream
793 ReadLineInputStream _in;
799 public Base64InputStream(ReadLineInputStream rlis)
805 public int read() throws IOException
807 if (_buffer==null || _pos>= _buffer.length)
809 //Any CR and LF will be consumed by the readLine() call.
810 //We need to put them back into the bytes returned from this
811 //method because the parsing of the multipart content uses them
812 //as markers to determine when we've reached the end of a part.
813 _line = _in.readLine();
815 return -1; //nothing left
816 if (_line.startsWith("--"))
817 _buffer=(_line+"\r\n").getBytes(); //boundary marking end of part
818 else if (_line.length()==0)
819 _buffer="\r\n".getBytes(); //blank line
822 ByteArrayOutputStream baos = new ByteArrayOutputStream((4*_line.length()/3)+2);
823 B64Code.decode(_line, baos);
826 _buffer = baos.toByteArray();
832 return _buffer[_pos++];