Tomcat servlet-mapping bypass if real file requested

[Chris Corbyn]

Is this possible at all? I know I can use a prefix or a suffix to be specific about the URI, but say I wanted to pass *all* requests via one particular servlet (front controller), except those which are directed a real file, can I do that?

<servlet-mapping>
  <servlet-name>front</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>

It's even crossed my mind to have the servlet look if the file exists and then stream it back if it does, but dealing with mime types doesn't stike me as a fun task, and the overhead of doing this seems a bit silly really.

Even this would be a suitable solution for me if it were possible:

<servlet-mapping>
  <servlet-name>front</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>
<servlet-mapping>
  <servlet-name>void</servlet-name>
  <url-pattern>*.css</url-pattern>
</servlet-mapping>
<servlet-mapping>
  <servlet-name>void</servlet-name>
  <url-pattern>*.jpg</url-pattern>
</servlet-mapping>

Where "void" means "don't use a servlet".

I'm basically looking to produce a clean URL mapper where the URL is parsed at runtime to determine what request parameters are in it (without the ?foo=bar mess).

Like this: http://www.symfony-project.com/book/trunk/09-Links-and-the-Routing-System

I guess if I were to check the URL at the first instance in the front controller I could minimize the overhead, and I can steal apache's mime-type list.

[Ben Souther]

It's usually easier to do things the other way around and set up specific mappings when you DO want to go to a servlet.

This usually done with a prefix that looks like a directory
/command/* or with a specific file extension like *.do.

Then you don't need specific mappings for css, js, jpg, gif, pdf, and whatever else you might need to access from the client.

[Chris Corbyn]

Yep, I do acknowledge that I'm experimenting as much as anything else really.

I got this to work pretty quickly. The first thing that happens in my front controller is the URI gets examined to see which action controller to dispatch. It's here that I do a simple check for a resource and stream it back as early as possible if something really does exist.

private void checkRealFile(ServletContext context, String path)
  throws CloseServletException, IOException {
    if ((path.length() >= 8) && path.substring(0, 8).equals("/WEB-INF")) {
      return;
    }
    URL url = null;
    try {
      url = context.getResource(path);
    } catch (MalformedURLException e) {
      throw new CloseServletException(e);
    }
    if (url == null) {
      return;
    }
    String mimeType = context.getMimeType(path);
    if (mimeType == null) {
      mimeType = "application/octet-stream";
    }
    ServletOutputStream os = null;
    InputStream is = null;
    try {
      os = getResponse().getOutputStream();
      is = url.openStream();
      getResponse().setContentType(mimeType);
      getResponse().setHeader("Content-Length", "" + is.available());
      byte b[] = new byte[8192];
      int c;
      while ((c = is.read(b)) > -1) {
        os.write(b);
        os.flush();
      }
      throw new CloseServletException("File output.");
    } finally {
      if (os != null) {
        os.close();
      }
      if (is != null) {
        is.close();
      }
    }
  }

The CloseServletException is a bit of a hack really, but it gets my front controller to jump to the end of processing and just return.

Tested downloading a 684MB file (adobe photoshop dmg image), displaying images and using CSS. All works nice and fast

My inexperience probably shows in my coding though.

This probably all looks a bit pointless to you right now but there is method in my logic for doing this... somewhere

[ramprasad madathil]

You could also fo it this way

Map all requests to your front controller servlet.
Place a Filter before your Servlet.

In the filter's doFilter() method, examine the request (the same logic as in your Front Controller from your last post). If the request is for a file, have the Filter serve the response back and don't pass on the request to the Servlet. Else do nothing, just pass it straight through.

 
public class FileServeFilter implements Filter{
 
    public void doFilter(ServletRequest request, 
   ServletResponse response, FilterChain chain) throws IOException, ServletException 
     {
        if(isRequestForFile(request)){
            serveFile(request, response);
            return;
        }
        chain.doFilter(request, response);
    }
 
    public boolean isRequestForFile(ServletRequest request){
        //logic to check if request is for file
    }
 
    public void serveFile(ServletRequest request, ServletResponse){
        //write back the output stream here
    }
}

You achieve 2 things this way.

1. The Servlet is still mapped to all requests.
2. The logic check is refactored away from the Servlet.

Just a suggestion.

cheers,
ram.

[Chris Corbyn]

Thanks for the tip. I didn't know you could do that. Refactoring now

I'm hoping this will fix a big i've found in using my code with safari. Image/CSS etc are not understood in safri, unless you go directly to them in the browser. I can only conclude that Safari sends some other requests that aren't for files bceause:

This fails (unless you point your browser directly to the image, and dont <img src /> to it):

<servlet-mapping>
    <servlet-name>front</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

But this works (which I though would have the same effect):

<servlet-mapping>
    <servlet-name>front</servlet-name>
    <url-pattern>*.do</url-pattern>
  </servlet-mapping>
<servlet-mapping>
    <servlet-name>front</servlet-name>
    <url-pattern>*.png</url-pattern>
  </servlet-mapping>

The second one still pushes everything I *thought* was in the request through the servlet, but clearly I was wrong because Safari gives a broken image if you link to it via <img>, yet it works if you copy the <img src=??? > into the address bar. Confusing.

I'll lt you know if your method solves that I'll add some ETag and Last-Modified checks too which would speed things up further.

[Chris Corbyn]

FYI, your suggestion worked a peach It fixed my wierd bug and it feels like it's being done in the proper place now. I've also moved my request routing/mapping logic into a filter.

The file check:

/**
 * Intercepts the request before it hits the front controller.
 * This filter is checking if the request that's been passed is for an actual file.
 * If the request is for a real file, the file is served and the servlet is skipped.
 */
 
package org.w3style.filter;
 
import java.io.IOException;
import java.io.InputStream;
import javax.servlet.ServletException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.ServletContext;
import javax.servlet.ServletOutputStream;
import java.net.URL;
import java.net.MalformedURLException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
 
/**
 * Checks the request for real files and intercepts the controller where needed.
 */
public class FileFilter implements Filter {
  /**
   * Filter configuration.
   */
  protected FilterConfig filterConfig;
  
  /**
   * Required init method to get config.
   * @param FilterConfig filterConfig
   */
  public void init(FilterConfig filterConfig) {
    this.filterConfig = filterConfig;
  }
  /**
   * Runs this filter.
   * @param ServletRequest request
   * @param ServletResponse response
   * @param FilterChain filterChain
   * @throws ServletException
   * @throws IOException
   */
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
  throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    String ctxPath = httpRequest.getContextPath();
    String requestUri = httpRequest.getRequestURI().substring(ctxPath.length());
    if (httpRequest.getMethod().equals("GET") && isFile(requestUri)) {
      serveFile(requestUri, response);
      return;
    }
    filterChain.doFilter(request, response);
  }
  /**
   * Checks if the servlet context is able to get a resource at this path.
   * @param String path
   * @return boolean
   * @throws IOException
   */
  private boolean isFile(String path) throws IOException {
    URL url = null;
    ServletContext context = filterConfig.getServletContext();
    try {
      url = context.getResource(path);
    } catch (MalformedURLException e) {
      return false;
    }
    if (url == null) {
      return false;
    }
    return true;
  }
  /**
   * Serves the file if possible.
   * If an error occurs, either a IOException will be raised, or nothing will be streamed
   * depending upon the cause of the error.
   * @param String path
   * @param ServletResponse response
   * @throws IOException
   */
  private void serveFile(String path, ServletResponse response) throws IOException {
    URL url = null;
    ServletContext context = filterConfig.getServletContext();
    try {
      url = context.getResource(path);
    } catch (MalformedURLException e) {
      return;
    }
    if (url == null) {
      return;
    }
    String mimeType = context.getMimeType(path);
    if (mimeType == null) {
      mimeType = "application/octet-stream";
    }
    ServletOutputStream os = null;
    InputStream is = null;
    try {
      os = response.getOutputStream();
      is = url.openStream();
      response.setContentType(mimeType);
      response.setContentLength(is.available());
      byte b[] = new byte[8192];
      int c;
      while ((c = is.read(b)) > -1) {
        os.write(b);
        os.flush();
      }
    } finally {
      if (os != null) {
        os.close();
      }
      if (is != null) {
        is.close();
      }
    }
  }
  /**
   * Required destroy() method.
   */
  public void destroy() {
    filterConfig = null;
  }
}

The request mapping is this:

/**
 * This class provides a filter for request mapping/routing.
 */
 
package org.w3style.filter;
 
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.ServletContext;
import org.w3style.router.RouterFactory;
import org.w3style.router.RouterFactoryException;
import org.w3style.router.Router;
import org.w3style.router.RouterException;
import org.w3style.Constants;
 
/**
 * All requests are passed through this filter which looks at the URI and does some translations.
 */
public class RouterFilter implements Filter {
  /**
   * The filter configuration.
   */
  protected FilterConfig filterConfig;
  
  /**
   * Required init() method, retrieve config.
   * @param FilterConfig filterConfig
   */
  public void init(FilterConfig filterConfig) {
    this.filterConfig = filterConfig;
  }
  /**
   * Perform filtering logic now.
   * @param ServletRequest request
   * @param ServletResponse response
   * @param FilterChain filterChain
   * @throws IOException
   * @throws ServletException
   */
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
  throws IOException, ServletException {
    ServletContext context = filterConfig.getServletContext();
    try {
      RouterFactory routerFactory = RouterFactory.newInstance(
        context.getResourceAsStream(Constants.ROUTING_FILE));
      Router router = routerFactory.createRouter();
      router.commit(context, (HttpServletRequest)request, (HttpServletResponse)response);
      context.setAttribute("router", router);
    } catch (RouterFactoryException e) {
      throw new ServletException(e);
    } catch (RouterException e) {
      throw new ServletException(e);
    }
    filterChain.doFilter(request, response);
  }
  /**
   * Required destroy() method.
   */
  public void destroy() {
    filterConfig = null;
  }
}

Which builds a request router using a series of strategies checking how well they can interpret the URI and offering a "score". Config looks like this (suffixes and prefixes non-important).

<?xml version="1.0" ?>
<router-mappings>
  <route>
    <name>Action</name>
    <description>
      This route maps the first two parts in the path with the module and action
    </description>
    <uri>/:module/:action/*</uri>
  </route>
  <route>
    <name>IndexAction</name>
    <description>
      Allows the module to be specified without the action for "Index" actions.
    </description>
    <uri>/:module</uri>
    <parameter>
      <key>action</key>
      <value>index</value>
    </parameter>
  </route>
</router-mappings>

The idea is that you can comletely configure the URL schema based on this XML file and you'll never need to use ?foo=bar style queries in the URL (like the symfony link I posted earlier).

[Ben Souther]

Safari (or any other browser for that matter) has no way of knowing what content on the server is static and what is dynamic. It just makes an HTTP request and receives an HTTP response.
[ August 19, 2007: Message edited by: Ben Souther ]

[Chris Corbyn]

Understood I'm not 100% what the problem was really with my first version, I just know that moving the code back a layer has helped, unless I inadvertently changed some logic along the way. I studied the headers that were being sent for a real file, and those for my streamed files and the only difference was ETag and Last-Modified.