Question

I have made use of Apache MyFaces Tomahawk to utilize file upload in a JSF project. I have successfully retrieve the uploaded file, however every time when I try to identify the file type, particularly for zip file, the getContentType() function always return application/octet-stream. Why is that so?

I suppose it is a config error in my web.xml, the following is the file:

<?xml version="1.0" encoding="UTF-8"?>
<web-app 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns="http://java.sun.com/xml/ns/javaee" 
    xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" 
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="WebApp_ID" version="3.0">

    <display-name>Project 1</display-name>

    <context-param>
        <param-name>facelets.LIBRARIES</param-name>
        <param-value>/WEB-INF/el-taglib.xml</param-value>
    </context-param>
    <context-param>
        <param-name>org.apache.myfaces.CHECK_EXTENSIONS_FILTER</param-name>
        <param-value>true</param-value>
    </context-param>

    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.xhtml</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>MyFacesExtensionsFilter</filter-name>
        <filter-class>org.apache.myfaces.webapp.filter.ExtensionsFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>MyFacesExtensionsFilter</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
    </filter-mapping>

    <mime-mapping>
        <extension>zip</extension>
        <mime-type>application/zip</mime-type>
    </mime-mapping>

</web-app>

Could anyone give me a hand?

Answer 1

The outcome of Tomahawk’s UploadedFile#getContentType() method is not been set by the server based on web.xml mime mapping, but by the client itself straight in the multipart/form-data header before sending it to the server. It’s thus merely extracted from the request body.

If it does not return the value you expect or desire, then you could always check the mime type based on the file extension of the uploaded file by ExternalContext#getMimeType().

String contentType = externalContext.getMimeType(uploadedFile.getName());

Keep however in mind that the file extension can be faked by the client (as could be the content type in the multipart/form-data header!), so detection based on extension (as well as the retrieved/determined content type!) is not necessarily robust enough. The client might for instance have renamed foo.exe to foo.zip or so. The best way to determine if the file is really a ZIP file is to just open the file as a ZIP file and catch any exception thrown. The standard Java SE API offers the ZipFile constructor for this.

Assuming that you’re storing uploaded files like follows (FilenameUtils and IOUtils are from Apache Commons IO, which you should already have as it’s one of the required dependencies of Tomahawk):

String prefix = FilenameUtils.getBaseName(uploadedFile.getName()); 
String suffix = FilenameUtils.getExtension(uploadedFile.getName());
File uploadLocation = new File("/path/to/uploads"); // Make it configureable!
File file = File.createTempFile(prefix + "-", "." + suffix, uploadLocation);

InputStream input = uploadedFile.getInputStream();
OutputStream output = new FileOutputStream(file);

try {
    IOUtils.copy(input, output);
} finally {
    IOUtils.closeQuietly(output);
    IOUtils.closeQuietly(input);
}

Then you should be able to determine if it’s a valid ZIP file as follows:

try {
    new ZipFile(file);
} catch (ZipException e) {
    // Here, we know that it's not a valid ZIP file!
}

See also:

• When do browsers send application/octet-stream as Content-Type?