If you must use ServletContext.getResourceAsStream(java.lang.String path) to read configuration files, the method will return an InputStream from the resource you are referencing, and I advise you to store such files in the WEB-INF folder.
If you want to write files, you should always provide (preferably in a custom location) the absolute path to the directory into which you must enter, and also make sure that it exists and has the appropriate permissions for such an operation.
source share