Accessing linux local file system from java web application

Question

we are using a java library inside a web application which is hosted in apache server.ReadConfFile method in library returns file not found error.The method is as follows

public byte[] ReadConfFile()
{
    try
    {
        File file = new File("/home/product/api/conf.txt");
        if(!file.exists())
            return "file not found".getBytes();
        byte[] buf = new byte[(int) file.length()];

        FileInputStream fis = new FileInputStream(file);
        fis.read(buf);
        return buf;
    } catch (IOException e)
    {
        e.printStackTrace();
        return null;
    }
}

Is local file system access from web application allowed?. If yes , then is there any access permission that has to be set?

I presume by apache you mean apache tomcat? What user does it run as? Does that user has read permissions on the location you have specified? Do you run with a SecurityManager? — Boris the Spider
– Boris the Spider, Commented Nov 14, 2013 at 7:51
Do you want to access the file system of the tomcat server or do you want to access the user's file system? The latter one is not possible (I think). — mvieghofer
– mvieghofer, Commented Nov 14, 2013 at 7:54

Matthias · Accepted Answer · 2013-11-14 07:56:20Z

9

To quickly answer your question: You can access the file system from a web application, but you would have to check your application server / web container on how to configure the SecurityManager (if one is installed).

However, your method of reading the file has severe issues which you should adress:

Do not check if(!file.exists()) better check if(!file.isFile()). The first check also returns true if the file is a directory.
If there is not a file, better not return a String, throw an Exception, or load some default Configuration or do something else which is useful.
Your logic for reading the file is very bad. If the read function returns a different amount of available bytes (maybe the read is chunked), you'll get a corrupt result.
You do not close the stream in a finally block, (or use a try with resources if you are using Java 7).
The exception handling is also not good. Printing the stacktrace is not good, logging it would be better. Handling the exception would be best (throw an exception, or switch to some default configuration, like when the file was not there).

Edit: If you want to access the client's file system, then this cannot be done from your web application running on the server directly. This of course would have to be done from code running on the client and you would have to fill in more details on what is running on the client side, since a "standard" web application would have Javascript and (X)HTML on the client, not java.

answered Nov 14, 2013 at 7:56

Matthias

3,5902 gold badges33 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Boris the Spider Over a year ago

Very, very sound advice. +1

dasumohan89 Over a year ago

Thanks for your answer Matthias.I will check for any configurations to be made with security manager.This is a sample method that i wrote for the issue and it's not going to be with production code(where we will close all streams and log exceptions). Your answer resembles your perfection and its great.

Philipp Jahoda Over a year ago

Good Answer. Could you evaluate "3." a little bit more and propose an alternative implementation?

Matthias Over a year ago

Yes, the code snippet asssumed that the buffer is fully read by the read function and this assumption is not valid. The read function returns how many bytes of the buffer are filled. Especially big files might not be read in one go.

Collectives™ on Stack Overflow

Accessing linux local file system from java web application

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related