Search code examples
tomcatwar

tomcat8 unpack war always remove my smlink file


When using command ./startup.sh in tomcat removed my symbolic link file.

How can I resolve this problem.

I don't want to remove my symbolic link file by tomcat.

Previous Description: My Environment [os: centos7, java: 1.8.0_131, spring version: 3.2.12.RELEASE]

  1. install and unpack apache-tomcat-8.5.15
  2. edit <Host name="localhost" appBase="" unpackWars="true" autoDeply="true"> in apache-tomcat-8.5.15/conf/server.xml
  3. execute command mkdir /home/data
  4. execute command ln -s /home/data apache-tomcat-8.5.15/uploadfiles, ln -s /home/data apache-tomcat-8.5.15/ROOT/uploadfiles
  5. File upload in /home/data apache-tomcat-8.5.15/ROOT/uploadfiles or /home/data apache-tomcat-8.5.15/uploadfiles
  6. execute command ./startup.sh
  7. tomcat happen removed files in apache-tomcat-8.5.15/ROOT/uploadfiles

I want use img file in symbolic link, from img tag path. but when excuted command ./startup.sh my removed img file. downloadservlet is not good at me.


Solution

  • Tomcat is doing exactly what you tell it to do: <Host ... unpackWars="true"> means that war-files will be unpacked, and Tomcat's webapps directory should not be messed around with.

    Further more: It's really bad practice to have an upload-directory right in tomcat's webapps directory, as you're opening yourself up to remote code execution vulnerabilities. Assume someone uploads a JSP file, then requests it: It will be compiled server-side and executed with the same permissions that Tomcat has. Not a pretty result.

    You're probably linking this directory to separate the application from uploaded files, for backup purposes. There's no need to map any directory into the webapps directory. Just provide a DownloadServlet that serves files from preconfigured locations and you're set.