最佳实践在 Java Web 应用程序中执行外部程序
我有一个java应用程序（实际上它是grails）我需要执行一个外部程序。最好我希望我的应用程序是独立的，即外部脚本/程序成为 war 文件的一部分。该外部脚本/程序还需要生成一些文件。
我想，我的问题是是否有某种最佳实践如何做这些事情，以便最终产品不会太不稳定，具体取决于应用程序权限等等？
I have a java app (in fact it is grails) I need to execute an external program. Preferably I want my app to be self-contained, i.e. the external scripts/programs to be part of the war file. This external script/program also needs to produce some files.
I guess, my question is if there is some kind of best practices how to do these sort of things so that the final product is not too flaky depending on app permissions and what not?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您需要确保的一件事是，一次只有一个线程执行程序的一个实例。所以你需要一些锁定和同步。
想象一下这样的场景：多个用户/请求/线程尝试使用不同的输入执行同一程序，这将是一场灾难。因此，您要么需要在一个程序正在执行而其他程序等待时锁定程序，要么需要在每次要运行该程序时创建新实例。你应该非常小心这一点。
另外，您希望在程序运行后以及它产生任何输出后进行清理。
如果用户可以向您的系统传递恶意命令并尝试劫持其他应用程序，您需要小心。
总的来说，你必须小心安全性和正确性（我提到的第一个方案。）
One of the things you need to ensure that, only one thread executes an instance of your program at a time. so you need some locking and synchronization there.
Imagine a scenario where multiple users/requests/threads trying to execute the same program with different input, that will be a disaster. so you either need to lock the program while one is executing and others wait, or you need to create new instances everytime you want to run the program. you should be very careful about this.
Also, you want to clean up after the program runs and if it produces any output.
You need to be careful if the user can pass malicious commands to your system and tries to hijack other applications.
Overall, you have to be careful about security and correctness (the first scheme i mentioned.)
安全性 - 确保您的应用程序不允许在主机系统上执行任意（用户提供的）代码。想想 SQL 注入式攻击。如果您需要传递数据，我建议首先将其插入数据库，然后将主键传递给外部进程，这将有助于避免缓冲区溢出类型的情况。
鲁棒性——这个程序会失败，或者需要很长时间，或者有其他未知的副作用。通过从不同的线程甚至不同的进程执行，将您的主 Web 应用程序与此程序隔离。
日志记录 - 如果您需要从此外部应用程序收集日志记录，您可能需要传入会话 ID（或等效项），以便可以跟踪 Web 会话的任何错误。
Security - ensure that your app does not allow for the execution of arbitary (user supplied) code on the host system. Think SQL-Injection style attacks. If you need to pass around data, I suggest inserting it into a database first and then passing the primary key to your external process, this will help avoid buffer overflow type situations.
Robustness - can this program fail, or take along time, or have other unknown side effects. Isolate your main web app from this program by executing from a different thread, or even a different process.
Logging - if you need to collect logging from this external app, you may want to pass in a session id (or equivalent) so you can track back any errors to web sessions.
您可以设计一个小型管理系统来跟踪服务请求。这将是一个非常有用的组件，因为大多数项目都有这样的目的。
应用程序应该从服务执行，对该服务本身的请求应该是异步的。除此之外，您还可以获得反馈并跟踪服务状态。
You could design a small administrative system that will track service requests. It would be a very useful component, as most projects have a purpose like this.
The app should be executed from a service, the request to that service itself should be asynchronous. Also on top of this you can get feedback and track that service status.