Is there an actual file stored to disk when using InputStream?

My company doesn't want sensitive data to be stored as files unless they're sanitized first. Anything in memory is fair game. So files d开发者_开发知识库ownloaded from an FTP server must be sanitized in memory before storing it on disk.

I'm using Jsch as my SFTP library and wondered whether or not using InputStream objects actually implies storing a temp file somewhere on disk by the JRE?

Using InputStream does not imply a file on disk. That doesn't mean Tomcat or some other intermediary doesn't store it temporarily (or the operating system itself).

The InputStream could be backed by a AudioInputStream, ByteArrayInputStream, FileInputStream, FilterInputStream, InputStream, ObjectInputStream, PipedInputStream, SequenceInputStream, StringBufferInputStream, or any other kind of InputStream.

They do realize that anything in memory can also go into a paging file at any time?

In any case, an InputStream need not generate a temp file.