OK, repeat after me, children:
A web server is not a file server
A web server is not a file server
A web server is not a file server
A file server is a place where you can read and write files via ordinary filesystem I/O calls. A web server is a place where you send HTTP requests and get HTTP responses. Web URLs may
look like file directory tree references, but it's only appearances, not reality. If the application running in the web server wants to root around the components of its WAR and return resources using the URL as a model, it may do so. However, if it chooses to do something entirely different, it can do that, too.
The one thing I'll say for certain, because somebody burned me quite badly on this within the last 6 months is that you should
never upload files into a WAR. Firstly, because unless the WAR is an exploded WAR, there's no directories to upload into;
J2EE doesn't support replacing parts of a WAR file.
Secondly - and this is where I got burned - even in the case of an exploded WAR, a redeployment of the webapp is likely to wipe out all those uploaded files.
There's nothing wrong with uploading files. Just upload them to a designated data directory, and not to an internal location in the webapp. You can hard-code a directory path into the app if you must, but personally, I prefer to make the upload directory a resource defined in web.xml, where JNDI can look it up and Tomcat can override it if it needs to.