JavaWeb文件上传与下载功能的实现教程与实战

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
 
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="avatar.jpg"
Content-Type: image/jpeg
 
<二进制数据>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Disposition: attachment; filename="report.xlsx"
Content-Length: 2048000
 
<二进制数据>

<form action="/upload" method="post" enctype="multipart/form-data">
  <input type="file" name="file" accept=".jpg,.png" required/>
  <button type="submit">上传</button>
</form>

const file = document.querySelector('input[type=file]').files[0];
const xhr = new XMLHttpRequest();
 
xhr.upload.onprogress = e => {
  const percent = Math.round(e.loaded / e.total * 100);
  document.querySelector('#bar').style.width = percent + '%';
};
 
xhr.open('POST', '/upload');
xhr.send(new FormData(document.querySelector('#form')));

const chunkSize = 2 * 1024 * 1024; // 2MB
const chunks = Math.ceil(file.size / chunkSize);
const spark = new SparkMD5.ArrayBuffer();
 
for (let i = 0; i < chunks; i++) {
  const start = i * chunkSize;
  const end = Math.min(start + chunkSize, file.size);
  const blob = file.slice(start, end);
  const md5 = await blob.arrayBuffer().then(b => SparkMD5.ArrayBuffer.hash(b));
  await fetch('/upload/chunk', {
    method: 'POST',
    body: JSON.stringify({ index: i, md5, chunk: blob }),
    headers: { 'Content-Type': 'application/octet-stream' }
  });
}
// 合并请求略

@WebServlet("/upload")
@MultipartConfig(
    maxFileSize = 10 * 1024 * 1024,       // 单个文件 10MB
    maxRequestSize = 50 * 1024 * 1024,    // 整个请求 50MB
    fileSizeThreshold = 1 * 1024 * 1024,  // 1MB 后写磁盘
    location = "/tmp")
public class UploadServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException, ServletException {
        Part part = req.getPart("file");
        String submitted = part.getSubmittedFileName();
        String ext = submitted.substring(submitted.lastIndexOf('.'));
        String uuid = UUID.randomUUID().toString();
        Path save = Paths.get("/data/file", uuid + ext);
        part.write(save.toAbsolutePath().toString());
 
        resp.getWriter().write("ok:" + uuid);
    }
}

# application.yml
spring:
  servlet:
    multipart:
      max-file-size: 10MB
      max-request-size: 50MB
      location: ${java.io.tmpdir}
      resolve-lazily: true # 大文件异步解析

@RestController
@RequestMapping("/api/file")
public class FileController {
 
    @Value("${file.store:/data/file}")
    private String storeDir;
 
    @PostMapping("/upload")
    public Map<String,String> upload(@RequestParam("file") MultipartFile file) {
        String ext = FilenameUtils.getExtension(file.getOriginalFilename());
        String name = UUID.randomUUID() + "." + ext;
        Path path = Paths.get(storeDir, name);
        try {
            Files.createDirectories(path.getParent());
            file.transferTo(path);
        } catch (IOException e) {
            throw new RuntimeException("上传失败", e);
        }
        return Map.of("url", "/api/file/" + name);
    }
 
    @GetMapping("/{name:.+}")
    public void download(@PathVariable String name,
                         HttpServletResponse resp) throws IOException {
        Path file = Paths.get(storeDir).resolve(name).normalize();
        if (!file.startsWith(Paths.get(storeDir))) {
            resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
            return;
        }
        resp.setContentType("application/octet-stream");
        resp.setHeader("Content-Disposition",
                "attachment; filename=\"" + URLEncoder.encode(name, StandardCharsets.UTF_8) + "\"");
        Files.copy(file, resp.getOutputStream());
    }
}

file:
  store-type: oss # local | nfs | oss
  oss:
    endpoint: oss-cn-beijing.aliyuncs.com
    bucket: my-file

private static final Map<String,String> MAGIC = Map.of(
        "jpg","FFD8FF","png","89504E47","pdf","25504446");
 
public boolean isValid(MultipartFile file) throws IOException {
    String mine = file.getContentType();
    if (!List.of("image/jpeg","image/png").contains(mine)) return false;
    try (InputStream is = file.getInputStream()) {
        byte[] b = new byte[8];
        is.read(b);
        String hex = bytesToHex(b).toUpperCase();
        return hex.startsWith(MAGIC.get(FilenameUtils.getExtension(file.getOriginalFilename())));
    }
}

Path target = Paths.get(storeDir, name).normalize();
if (!target.startsWith(Paths.get(storeDir))) {
    throw new SecurityException("非法路径");
}

@Async
public void virusScan(Path file) {
    int exit = new ProcessBuilder("clamscan", "--no-summary", file.toString())
            .inheritIO().start().waitFor();
    if (exit != 0) {
        Files.deleteIfExists(file);
        throw new RuntimeException("病毒检测失败");
    }
}

@PostMapping("/chunk")
public String chunk(@RequestBody ChunkDto dto) {
    String key = "chunk:" + dto.getMd5() + ":" + dto.getIndex();
    redisTemplate.opsForValue().set(key, "1", Duration.ofHours(1));
    Path path = Paths.get(tmpDir, dto.getMd5() + "-" + dto.getIndex());
    Files.write(path, dto.getData());
    return "ok";
}

@Async("mergeExecutor")
public void merge(String md5, int chunks) {
    try (FileChannel out = FileChannel.open(Paths.get(storeDir, md5),
            StandardOpenOption.CREATE, StandardOpenOption.WRITE)) {
        for (int i = 0; i < chunks; i++) {
            Path c = Paths.get(tmpDir, md5 + "-" + i);
            try (FileChannel in = FileChannel.open(c)) {
                in.transferTo(0, in.size(), out);
            }
            Files.delete(c);
        }
    }
}

private static final Map<String,String> ALLOW = Map.of(
    "jpg","image/jpeg","png","image/png",
    "pdf","application/pdf","docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document");

Path target = Paths.get(storeDir, name);