参考文献：
1.下载地址
Apache-》Projects-》HttpComponents
2.DownloadServlet
1 packagecom.servlet;2
3 importjava.io.BufferedInputStream;4 importjava.io.BufferedOutputStream;5 importjava.io.File;6 importjava.io.FileInputStream;7 importjava.io.IOException;8 importjava.io.InputStream;9 importjava.io.OutputStream;10 importjava.net.URLDecoder;11 importjava.net.URLEncoder;12
13 importjavax.servlet.ServletException;14 importjavax.servlet.http.HttpServlet;15 importjavax.servlet.http.HttpServletRequest;16 importjavax.servlet.http.HttpServletResponse;17
18
19
20 public class DownloadServlet extendsHttpServlet {21
22 private static final long serialVersionUID = 1L;23
24 public voiddoGet(HttpServletRequest request, HttpServletResponse response)25 throwsServletException, IOException {26 String filename = request.getParameter(“id”);27 String fileUrl = request.getServletContext().getRealPath(“”).replace(“\\”, “/”);28 fileUrl = fileUrl + “/files/document/” +filename;29 System.out.println(“fileUrl:”+fileUrl);30 String rname = new String(filename.getBytes(“utf-8”));31 System.out.println(“begin:”+rname);32 rname =URLEncoder.encode(rname);33 System.out.println(“end:”+rname);34 response.addHeader(“Content-Disposition”, “attachment;filename=”+rname);35 response.setContentType(“application/octet-stream”);36
37 File file = newFile(fileUrl);38 InputStream is = new BufferedInputStream(newFileInputStream(file));39 byte[] buffer = new byte[is.available()];40 is.read(buffer);41 is.close();42
43 OutputStream os = newBufferedOutputStream(response.getOutputStream());44 os.write(buffer);45 os.flush();46 os.close();47 }48
49
50 public voiddoPost(HttpServletRequest request, HttpServletResponse response)51 throwsServletException, IOException {52
53
54 }55
56
57 }58
59
3.ClientA.java
packagecom.tool;importjava.io.File;importjava.io.FileOutputStream;importjava.io.IOException;importjava.io.InputStream;importjava.io.OutputStream;importorg.apache.http.HttpResponse;importorg.apache.http.client.ClientProtocolException;importorg.apache.http.client.HttpClient;importorg.apache.http.client.methods.HttpGet;importorg.apache.http.impl.client.DefaultHttpClient;public classClientA {/***
*@paramargs*/
public static voidmain(String[] args) {//TODO 自动生成的方法存根
ClientA client = newClientA();
client.service();
}public voidservice() {//TODO 自动生成的方法存根
String url= “http://此处填写ip或网址/download.do”;
HttpClient client= newDefaultHttpClient();
HttpGet get= newHttpGet(url);try{
HttpResponse response=client.execute(get);}catch(ClientProtocolException e) {//TODO Auto-generated catch block
e.printStackTrace();
}catch(IOException e) {//TODO Auto-generated catch block
e.printStackTrace();
}
}
}
4.注意服务器的编码方式和客户端的区别
统一为utf-8
5.注意目录遍历漏洞
目录遍历是通过操作URL强行访问web目录以外的文件，目录和命令，攻击者可以在目标机器的任何位置访问文件，执行命令。
最基本的目录遍历攻击技术是在URL中使用”../”序列，改变访问资源的路径，访问到web目录以外的文件。
例如：
http://example.com/../../../../some/file
http://example.com/..%255c..%255c/some/file
正常请求为:
http://example.com/test.cgi?look=intex.html
如果存在目录遍历漏洞，攻击者可以访问
http://example.com/test.cgi?look=test.cgi
解决办法：
过滤请求数据中”../”字符序列及其各种变形。
验证用户请求中提交的需要访问的文件是否在限定的范围内。
java web使用fliter过滤url即可。