Question

I wrote the following servlet, it converts the input to uppercase :

 public class TestServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        InputStream in=req.getInputStream();
        OutputStream out=resp.getOutputStream();
        byte array[]=new byte[1024];
        int nReads;
        while((nReads=in.read(array))!=-1)
            {
            for(int i=0;i<nReads;++i)
                {
                array[i]=(byte)Character.toUpperCase(array[i]);
                }
            out.write(array, 0, nReads);
            }
        out.flush();
        out.close();
        }
    }

it works fine:

echo "aaaaaaaaaaaaaaaaaaaaaaaaaaa" |\
curl -d @- "http://localhost:8080/app/test"
AAAAAAAAAAAAAAAAAAAAAAAAAAAl

is it safe to deploy such servlet ? what are the pitfalls of this kind of servlet ? for example,how can I prevent a user to block an instance of my servlet forever:

 cat  | curl -d @- "http://localhost:8080/app/test/x"

Answer 1

No, you can’t pipe a stream to a servlet. HTTP doesn’t really provide for input streams.

Your command works because cat returns once it’s done outputting data. curl then grabs all that data and sends it. However, curl won’t send anything until it’s done getting the data.

This does, of course, have the advantage that it doesn’t block an instance of your servlet, since the blocking happens at curl, not the servlet.