servelt远程文件下载

import java.io.File;

import java.io.FileInputStream;

import java.io.IOException;

import java.net.URLEncoder;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

/**

* 下载文件的Servlet

*

*/

public class DownloadEntry extends HttpServlet {

/**

* 下载文件的方法

*/

protected void doGet(HttpServletRequest request,

HttpServletResponse response) throws ServletException, IOException {

request.setCharacterEncoding("UTF-8");

String fileName = request.getParameter("fileName");

String dir = request.getParameter("dir");

/**

* 以下代码为了防止用户输入../等路径去访问系统的其他文件

* 如http://yanmentang.com:80/download?

dir=contract&fileName=/../..//../..//../..//../..//../..//etc/passwd

*/

if (fileName.indexOf("../") != -1 || fileName.indexOf("/..") != -1

|| fileName.indexOf("..\\") != -1 || fileName.indexOf("\\..") != -1) {

return;

}

if (dir.indexOf("../") != -1 || dir.indexOf("/..") != -1

|| dir.indexOf("..\\") != -1 || dir.indexOf("\\..") != -1) {

return;

}

if (!dir.equals("shopOrderExport") && !dir.equals("contract")) {

return;

}

String downloadDir = AppKeys.UPLOAD_FILE_PATH

+ File.separator + dir + File.separator;

response.setContentType("APPLICATION/OCTET-STREAM");

String downDateStr = DateTimeUtil.getCurrentDate().replaceAll("-", "").replaceAll(" ", "");

response.setHeader("Content-Disposition", "attachment; filename=\""

+ URLEncoder.encode(fileName.substring(0, fileName.indexOf(".")) + downDateStr + fileName.substring(fileName.indexOf(".")), "UTF-8") + "\"");

FileInputStream fileInputStream = null;

try {

// 打开指定文件的流信息

fileInputStream = new java.io.FileInputStream(downloadDir

+ fileName);

// 写出流信息

int i;

while ((i = fileInputStream.read()) != -1) {

response.getOutputStream().write(i);

}

} catch (Exception e) {

AppLogger.getInstance().errorLog("error happened when download file: " + fileName, e);

} finally {

try {

if (fileInputStream != null) {

fileInputStream.close();

}

} catch (Exception e) {

}

response.getOutputStream().close();

}

}

}