Determine the size of a file upload before reading it all in in the Apache FileUpload Streaming API

Question

There are two ways to use the Apache FileUpload Library.

FileUpload

http://commons.apache.org/fileupload/using.html

And Streaming FileUpload API

http://commons.apache.org/fileupload/streaming.html

They both work great except that the streaming API does not seem to have a way to check the fileSize before processing the stream.

Is this because the Streaming API fundamentally does not know the file size or because I need to manually read some headers or something to get the Multipart upload size?

Pancho

Answer 1

There's no way to know the size of a part of a multipart request without consuming the whole HTTP request body. And once the consuming of the HTTP request body has started, you cannot stop consuming it halfway. It has to be consumed until the last byte before a response can ever be returned. That's just the nature of HTTP and TCP/IP. To keep the server memory usage low, you can however just discard the read bytes when they exceeds the size (i.e. check it inside the read loop and don't assign them to any variable).

Your best bet is to validate the file length in JavaScript before the upload takes place. This is supported in browsers supporting HTML5 File API. The current versions of Firefox, Chrome, Safari, Opera and Android support it. IE9 doesn't support it yet, it'll be in the future IE10.

<input type="file" ... onchange="checkFileSize(this)" />

Where the checkFileSize() look something like this

function checkFileSize(inputFile) {
    var max = 10 * 1024 * 1024; // 10MB

    if (inputFile.files && inputFile.files[0].size > max) {
        alert("File too large."); // Do your thing to handle the error.
        inputFile.value = null; // Clear the field.
    }
}

Highminded

With due respect to Balus ... on the server side, since the OP is asking about that and not on the client (JS) side... this is not a good way to check. The header "Content-Length" is set by the client and cannot or should not be trusted. On the server side, using the streaming API plus the "Content-Length" from the header, one can determine at least how big the file "might be" based on: ContentLength (sum) - header bytes read until the file-item start reached in the multi-part request. Using streaming API, read chunks and sum to protect against too-large upload. – Crossways