tds/src/main/java/thredds/servlet/ServletUtil.java
public static void returnFile(HttpServlet servlet, String contentPath, String path,
                                HttpServletRequest req, HttpServletResponse res, String contentType) throws IOException {

    String filename = ServletUtil.formFilename(contentPath, path);

    log.debug("returnFile(): returning file <" + filename + ">.");
    // No file, nothing to view
    if (filename == null) {
      res.sendError(HttpServletResponse.SC_NOT_FOUND);
      return;
    }

    // dontallow ..
    if (filename.contains("..")) {
      res.sendError(HttpServletResponse.SC_FORBIDDEN);
      return;
    }

    // dont allow access to WEB-INF or META-INF
    String upper = filename.toUpperCase();
    if (upper.contains("WEB-INF") || upper.contains("META-INF")) {
      res.sendError(HttpServletResponse.SC_FORBIDDEN);
      return;
    }

    returnFile(servlet, req, res, new File(filename), contentType);
  }
public static void returnFile(HttpServlet servlet, String contentPath, String path,
                                HttpServletRequest req, HttpServletResponse res, String contentType) throws IOException {

    String filename = ServletUtil.formFilename(contentPath, path);

    log.debug("returnFile(): returning file <" + filename + ">.");
    // No file, nothing to view
    if (filename == null) {
      res.sendError(HttpServletResponse.SC_NOT_FOUND);
      return;
    }

    // dontallow ..
    if (filename.contains("..")) {
      res.sendError(HttpServletResponse.SC_FORBIDDEN);
      return;
    }

    // dont allow access to WEB-INF or META-INF
    String upper = filename.toUpperCase();
    if (upper.contains("WEB-INF") || upper.contains("META-INF")) {
      res.sendError(HttpServletResponse.SC_FORBIDDEN);
      return;
    }

    returnFile(servlet, req, res, new File(filename), contentType);
  }
public static void returnFile ( HttpServlet servlet , String contentPath , String path , HttpServletRequest req , HttpServletResponse res , String contentType ) throws IOException { String filename = ServletUtil . formFilename ( contentPath , path ) ; log . debug ( "returnFile(): returning file <" + filename + ">." ) ; // No file, nothing to view
 if ( filename == null ) { res . sendError ( HttpServletResponse . SC_NOT_FOUND ) ; return ; } // dontallow ..
 if ( filename . contains ( ".." ) ) { res . sendError ( HttpServletResponse . SC_FORBIDDEN ) ; return ; } // dont allow access to WEB-INF or META-INF
 String upper = filename . toUpperCase ( ) ; if ( upper . contains ( "WEB-INF" ) || upper . contains ( "META-INF" ) ) { res . sendError ( HttpServletResponse . SC_FORBIDDEN ) ; return ; } returnFile ( servlet , req , res , new File ( filename ) , contentType ) ; }
Write a file to the response stream.

@param servlet     called from this servlet, may be null
@param contentPath file root path
@param path        file path reletive to the root
@param req         the request
@param res         the response
@param contentType content type, or null
@throws IOException on write error
Write a file to the response stream .