Restricting file upload size in JSF

Question

I am using the Tomahawk inputFileUpload component to allow users to upload files to a server. I have implemented a "soft" file size limit by checking the size of the file after it has been uploaded and displaying an error if it is too large. However I would also like a larger "hard" limit, where uploading immediately stops once it has passed the limit. For example if the hard limit is 500MB and the user attempts to upload a 2GB file, uploading will immediately stop once 500MB has been uploaded and an error is displayed.

I had hoped that using the MyFaces ExtensionsFilter and setting uploadMaxFileSize would fix the problem, but the file is completely uploaded before the SizeLimitExceededException is thrown.

Is it possible to do this? Ideally I'd still be able to use Tomahawk but any other solution would be good.

BalusC · Accepted Answer · 2012-05-09T01:53:04.793

9

The web server can't abort a HTTP request halfway and then return a HTTP response. The entire HTTP request has to be consumed fully until the last bit before a HTTP response can ever be returned. That's the nature of HTTP and TCP/IP. There's nothing you can do against it with a server side programming language.

Note that the Tomahawk file upload size limit already takes care that the server's memory/disk space won't be polluted with the entire uploaded file whenever the size limit has been hit.

Your best bet is to validate the file length in JavaScript before the upload takes place. This is supported in browsers supporting HTML5 File API. The current versions of Firefox, Chrome, Safari, Opera and Android support it. IE9 doesn't support it yet, it'll be in the future IE10.

<t:inputFileUpload ... onchange="checkFileSize(this)" />

with something like this

function checkFileSize(inputFile) {
    var max = 500 * 1024 * 1024; // 500MB

    if (inputFile.files && inputFile.files[0].size > max) {
        alert("File too large."); // Do your thing to handle the error.
        inputFile.value = null; // Clears the field.
    }
}

edited May 09 '12 at 01:53

answered May 09 '12 at 01:47

BalusC

1,082,665
372
3,610
3,555

Is there any way to stop the upload, irrespective of what is returned to the user? It seems crazy that a user with IE9 will be able to upload a massive file and the only option is to accept the whole thing before immediately deleting it. – jwaddell May 09 '12 at 03:27
As explained, there is no way. And as said, when the size limit is exceeded, the read request bytes are just ignored. This doesn't affect server's memory/disk space. – BalusC May 09 '12 at 03:34
@BalusC..Does this approach works with Primefaces file upload? – SRy Nov 13 '12 at 00:04
I suppose adding a jsf validator for the file size would be a nice addition for people who bypass the restriction client side and you don't end up with 2TB of dick pics – Ced Mar 25 '16 at 21:38
@Ced: OP mentioned to already have a hard limit (configured in server). This is hit before JSF runs. – BalusC Mar 27 '16 at 15:32
yeah I was pointing it out for any future reader since the limit is often higher than what one might allow by the js file api (like max 40kb). I think it's worth mentionning – Ced Mar 27 '16 at 17:47

score 2 · Answer 2 · edited May 23 '17 at 11:44

Try this:

<div>
    <p:fileUpload id="fileUpload" name="fileUpload" value="#{controller.file}" mode="simple" rendered="true"/>
    <input type="button" value="Try it" onclick="checkFileSize('fileUpload')" />

</div>

When user click in the button "Try it", checkFileSize() function is called and the fileUpload primefaces component is validated. If file size is greater than 500MB the file not is uploaded.

<script>
    // <![CDATA[
        function checkFileSize(name) {
            var max = 500 * 1024 * 1024; // 500MB
            var inputFile = document.getElementsByName(name)[0];
            var inputFiles = inputFile.files; 

            if (inputFiles.lenght > 0 && inputFiles[0].size > max) {
                alert("File too large."); // Do your thing to handle the error.
                inputFile.value = null; // Clears the field.
            }
        }
    // ]]>
</script>

The checkFileSize() logic is based on the BalusC answered above.

Versions tested:

primefaces 3.5

jsf 2.1

Restricting file upload size in JSF

2 Answers2

Linked