Spring Boot 3.0.0替代CommonsMultipartResolver方案咨询

Spring Boot 3.0（对应Spring Framework 6.0）已移除对CommonsMultipartResolver的支持，推荐基于Servlet 3.0+原生实现的StandardServletMultipartResolver，同时可以通过拆分原有自定义逻辑到独立组件的方式，完成平滑迁移。以下是具体方案：

一、基础配置：启用StandardServletMultipartResolver #

Spring Boot 3.0默认已自动配置StandardServletMultipartResolver，无需额外定义Bean。如果需要自定义上传参数，直接在配置文件中设置即可：

application.yml 配置示例 #

spring:
  servlet:
    multipart:
      enabled: true
      max-file-size: ${upload.document.max.file.size}  # 对应原maxFileSize配置
      max-request-size: 10MB  # 可选：设置整个请求的最大大小
      resolve-lazily: true    # 对应原resolveLazily配置，开启懒加载解析

如果需要更底层的Servlet配置，可注册MultipartConfigElement Bean：

@Configuration
public class MultipartConfig {

    @Value("${upload.document.max.file.size}")
    private long maxFileSize;

    @Value("${upload.document.directory}")
    private String uploadedDocumentPath;

    @Bean
    public MultipartConfigElement multipartConfigElement() {
        MultipartConfigFactory factory = new MultipartConfigFactory();
        factory.setMaxFileSize(DataSize.ofBytes(maxFileSize));
        factory.setLocation(uploadedDocumentPath); // 设置临时文件存储路径
        return factory.createMultipartConfig();
    }
}

二、迁移原有自定义逻辑 #

原MyMultipartResolver中的验证、参数清理等逻辑，可拆分到独立组件中实现：

1. 文件验证逻辑：提取为独立服务 #

把原validateAttachment方法封装成专门的验证服务，可在控制器或拦截器中调用：

@Service
public class FileUploadValidationService {

    @Autowired
    private SessionService sessionService;

    @Autowired
    private UserFileUploadEventService userFileUploadEventService;

    @Value("${file.supportedMimeTypes}")
    private String supportedMimeTypes;

    @Value("${upload.document.max.file.size}")
    private int maxFileSize;

    @Value("${scep.executable.path}")
    private String scepExePath;

    public void validateAttachment(MultipartFile file) throws BadRequestException {
        final long fileSize = file.getSize();
        final String simpleFileName = file.getOriginalFilename();

        if (simpleFileName == null || simpleFileName.isEmpty()) {
            throw new BadRequestException(RestConstants.FILE_UPLOAD_INVALID_FILE_TYPE);
        }
        if (isFrequencyAttack()) {
            throw new BadRequestException(RestConstants.FILE_UPLOAD_FREQUENCY_VIOLATION);
        }
        if (!isValidMimeType(file)) {
            throw new BadRequestException(RestConstants.FILE_UPLOAD_INVALID_FILE_TYPE);
        }
        if (fileSize > maxFileSize) {
            throw new BadRequestException(RestConstants.FILE_UPLOAD_INVALID_FILE_SIZE);
        }
        if (containsThreat(file)) {
            throw new BadRequestException(RestConstants.FILE_UPLOAD_MALICIOUS_FILE_DETECTED);
        }
    }

    // 保留原有实现方法
    private boolean isFrequencyAttack() {
        // 原上传频率校验逻辑
        return false;
    }

    private boolean isValidMimeType(MultipartFile file) {
        // 原MIME类型校验逻辑
        return true;
    }

    private boolean containsThreat(MultipartFile file) {
        // 原恶意文件检测逻辑（调用scepExePath）
        return false;
    }
}

2. Multipart参数XSS清理：用过滤器实现 #

原getSanitizedMultipartparameters的参数清理逻辑，可通过自定义过滤器在请求到达控制器前处理：

@Component
public class MultipartParameterSanitizingFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if (request instanceof MultipartHttpServletRequest) {
            MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
            Map<String, String[]> sanitizedParams = new HashMap<>();

            for (Map.Entry<String, String[]> entry : multipartRequest.getParameterMap().entrySet()) {
                sanitizedParams.put(entry.getKey(), AntiSamyHelper.sanitizeXSS(entry.getValue()));
            }

            // 包装请求，返回清理后的参数
            HttpServletRequest wrappedRequest = new HttpServletRequestWrapper(multipartRequest) {
                @Override
                public String[] getParameterValues(String name) {
                    return sanitizedParams.getOrDefault(name, super.getParameterValues(name));
                }

                @Override
                public Map<String, String[]> getParameterMap() {
                    return sanitizedParams;
                }
            };
            filterChain.doFilter(wrappedRequest, response);
        } else {
            filterChain.doFilter(request, response);
        }
    }
}

3. 控制器中集成验证逻辑 #

在文件上传接口中直接注入验证服务，完成前置校验：

@RestController
@RequestMapping("/upload")
public class FileUploadController {

    @Autowired
    private FileUploadValidationService validationService;

    @PostMapping
    public ResponseEntity<String> uploadFile(@RequestParam("file") MultipartFile file) {
        validationService.validateAttachment(file);
        // 执行文件上传业务逻辑
        return ResponseEntity.ok("上传成功");
    }
}

三、为什么弃用CommonsMultipartResolver #

Servlet 3.0+已提供原生文件上传支持，StandardServletMultipartResolver无需依赖Apache Commons FileUpload库，更轻量且性能更优，因此Spring Framework 6.0正式移除了对CommonsMultipartResolver的支持。

内容的提问来源于stack exchange，提问作者feltspar