FIO15-J. Do not reset a servlet's output stream after committing it

When a web servlet receives a request from a client, it must produce some suitable response. Java's HttpServlet provides the HttpServletResponse object to capture a suitable response. This response can be built using an output stream provided by getOutputStream() or a writer provided by getWriter().

A response is said to be committed if its status code and HTML headers have been sent. [J2EE API 2013]. After a response is committed, further data may be added to the response, but certain behaviors become impossible. For example, it is impossible to change the character encoding, because the encoding is included in the HTML header. Some of these illegal operations will yield a IllegalStateException, while others will have no effect. These illegal behaviors include:

• Resetting the stream or re-committing to the stream
• Flushing the stream or writer's buffer
• Invoking either getWriter() or getOutputStream()
• Redirecting an HttpServletResponse to another server
• Modifying the stream's character encoding, content type or buffer size

Noncompliant Code Example

This noncompliant code example shows an example where ...

Compliant Solution

In this compliant solution, ...

Risk Assessment

If a servlet's output stream is reset after it has been committed, an IllegalStateException usually results, which can cause the servlet's response to be truncated.

Automated Detection

Bibliography