انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-023

عمليات الملفات

  • 6 درس
  • 2 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • الرفع متعدد الأجزاء (Multipart uploads)
  • التنزيلات
  • البث (Streaming)
  • قيود حجم الملف

تعلّم أولًا

2 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Accept multipart uploads and enforce size and content-type limits.
  2. Stream downloads without loading whole files into memory.
  3. Store uploaded files outside the application with generated names.
  4. Explain upload-related risks (path traversal, oversized files, content sniffing).

الدروس

  1. 01الرفع متعدد الأجزاء (Multipart uploads)
  2. 02الحدود والتحقق
  3. 03البث عند التنزيل
  4. 04أين نخزّن الملفات
  5. 05أمان الرفع
  6. 06عرض عملي: رفع صورة منتج وتنزيلها بالبث

المختبر والتمارين

Lab

JNR-023-LAB1 · Product images

Outcomes: 1–4 · Time: ~2 h Upload, list, and download product images in Shop API. Enforce a size limit and a content-type allow-list; store files in a configured directory outside the application using generated names; stream downloads. Complete the security checklist below.

Security checklist: filename never used in a path; size limit enforced; content type allow-listed; files outside the JAR; nosniff header set; downloads only through the controller.

Acceptance: path traversal attempt rejected; 20 MB file rejected.

Exercises (assessment: lab plus security checklist)

IDOutcomeTask
JNR-023-EX011Implement a multipart endpoint and upload a file with curl -F.
JNR-023-EX021Configure a 2 MB limit and show the response for a 3 MB file.
JNR-023-EX031Reject files whose content type is not image/png or image/jpeg, and empty files.
JNR-023-EX042Return a stored file as a Resource with the right Content-Type, and 404 when missing.
JNR-023-EX053Store uploads in a configured external directory using UUID names, with the original name kept as metadata.
JNR-023-EX064Explain path traversal, oversized files, and content sniffing, each with one prevention.
أظهر الحلول
  • EX01 curl -i -F "file=@pen.png" localhost:8080/products/1/images.
  • EX02 spring.servlet.multipart.max-file-size=2MB; the response is an error status (413 or a mapped one) with a clear body.
  • EX03 Set.of("image/png","image/jpeg").contains(file.getContentType()); file.isEmpty() gives 400.
  • EX04 new FileSystemResource(path) in ResponseEntity.ok().contentType(...).body(resource); missing record gives 404.
  • EX05 String stored = UUID.randomUUID().toString(); Files.copy(file.getInputStream(), base.resolve(stored));
  • EX06 Path traversal: never use the client name, normalize and check startsWith(base). Oversized files: size limits. Sniffing: correct Content-Type plus X-Content-Type-Options: nosniff.

Outcome 4 is also covered by the security checklist and quiz Q08 to Q10.

الاختبار

Outcomes: O1 uploads and limits · O2 streaming downloads · O3 storage · O4 upload risks.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1File uploads use which content type?O1
  2. 2A Spring type for an uploaded file is:O1
  3. 3Why check content type and size?O1
  4. 4Streaming a download avoids:O2
  5. 5Which return type suits a file download?O2
  6. 6Where should uploads be stored?O3
  7. 7Who chooses the stored filename?O3
  8. 8A filename ../../secret.txt is an example of:O4
  9. 9Best defense against that attack:O4
  10. 10X-Content-Type-Options: nosniff helps against:O4

الجزء العملي

Six exercises JNR-023-EX01 to EX06, the product-images lab, and the security checklist. Pass: at least five exercises and a lab that rejects the traversal attempt and the 20 MB file.

أخطاء شائعة

Trusting the client's filename or content type; storing files inside the JAR's directory.

التقييم

Lab plus security checklist.

الصلة بالمسار الوظيفي

Object storage (MID-056, ARC-015).

اكتب للبحث في المستويات والمراحل والوحدات والدروس.