commons-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Martin Cooper" <>
Subject Re: [FileUpload] Speeding up uploads
Date Thu, 12 Jun 2003 09:09:14 GMT

"Rademacher Tobias" <> wrote in message
> Hi Martin,
> > The maximum size configuration has nothing to do with memory
> > usage. In the
> > default implementation, the entire upload is almost never retained in
> > memory, unless it is very small. Once it passes a
> > configurable threshold, it
> > is written to disk instead.
> Doesn't disk writing introduced new weaknesses?
> PHP does it similar it copies a file into the tmp directory of the server.
> So developers have to move the file localy.
> Is this simlilar implemented in FileUpload?

If you are concerned about this, it would really be worth your while to take
some time and read the FileUpload documentation, and the JavaDocs. All of
this is configurable and/or customisable. The default implementation writes
to the container's temp directory when a file item exceeds a certain size.
You can configure the upload directory; you can configure the threshold; and
you can provide your own FileItem[Factory] implementation so that you have
control over where the data is stored. (For example, you might decide to
stream it directly to a database, or just drop it if it gets too big.)

> >
> > The main reason for the maximum size configuration is so that
> > clients are
> > constrained in how much data they can send to the server,
> > which also helps
> > to prevent DoS attacks. Do you really want some random hacker
> > uploading a
> > 100GB file to your web server? ;-)
> Good point so I really understand what the max size configuration is for.
> :-)
> Do I have to increase JVM max memory when i would allow let's say 200MB?
> What does the interally byte buffer consume?

A large upload request will not be retained in memory (unless you configure
it that way), so no, you don't have to change your JVM settings.

The default buffer size for parsing the request is 4KB. Although the
MultipartStream class allows that size to be configured, the current
FileUpload implementation provides no way to override that default. This is
actually a good thing, at this point in time. The problem is that there is a
non-obvious interaction between the buffer size and the algorithm used to
detect multipart boundaries. You need to understand both rather well before
you can meaningfully configure either.

Martin Cooper

> Bye and Thx
> Toby

View raw message