How to check the content of an uploaded file without relying on its extension?

Question

How do you go about verifying the type of an uploaded file reliably without using the extension? I'm guessing that you have to examine the header / read some of the bytes, but I really have no idea how to go about it. Im using c# and asp.net.

Thanks for any advice.

ok, so from the above links I now know that I am looking for 'ff d8 ff e0' to positively identify a .jpg file for example.

In my code I can read the first twenty bytes no problem:

                FileStream fs = File.Open(filePath, FileMode.Open);
                Byte[] b = new byte[20];
                fs.Read(b, 0, 20);

so (and please excuse my total inexperience here) but how do I check whether the byte array contains 'ff d8 ff e0'?

score 4 · Accepted Answer · answered Oct 29 '08 at 01:21

Here's a quick-and-dirty response to the followup question you posted:

byte[] jpg = new byte[] { 0xFF, 0xD8, 0xFF, 0xE0 };
bool match = true;
for (int i = 0; i < jpg.Length; i++)
{
    if (jpg[i] != b[i])
    {
        match = false;
        break;
    }
}

score 2 · Answer 2 · answered Oct 28 '08 at 23:01

That indeed is what the Unix file program does, with greater or lesser degrees of reliability. In part, it depends on whether the programs whose files you are trying to detect emits a file header; the program tar is notorious for not doing so. It depends on how many types of files you plan to try and recognize, but it might well be simplest to use an implementation of file; it recognizes many file types, and modern versions are extensible via a file of extra file type definitions that can handle a multitude of scenarios.

Lou Franco · Answer 3 · 2022-05-04T02:43:23.257

2

~~Wotsit~~ is a good resource for finding out the magic numbers for various file types.

Edit: link is broken. Here’s a better resource that is still being updated

https://www.garykessler.net/library/file_sigs.html

edited May 04 '22 at 02:43

answered Oct 28 '08 at 23:31

Lou Franco

87,846
14
132
192

The link is broken. – David Klempfner May 04 '22 at 01:31
1

@DavidKlempfner added another link to check for resources – Lou Franco May 04 '22 at 02:44
Is there no nuget package that validates file content? I can't seem to find one. – David Klempfner May 04 '22 at 02:47

score 1 · Answer 4 · answered Oct 28 '08 at 23:00

1

The first few bytes of a file will often tell you the file type. See, for example,
http://www.garykessler.net/library/file_sigs.html
http://www.astro.keele.ac.uk/oldusers/rno/Computing/File_magic.html

Use System.IO to read the byes as binary after the upload.

I'm curious, though, why you can't rely on on the ContentType header?

answered Oct 28 '08 at 23:00

Corey Trager

22,649
18
83
121

because I'm using a component that streams everything as binary! – flesh Oct 28 '08 at 23:01
The first link is much more comprehensive than the second. – Jonathan Leffler Oct 28 '08 at 23:15
2

You can't rely on Content-Type because the client may be hostile and deliberately claim an incorrect Content-Type as part of an attack. Trusting Content-Type is little, if any, better than trusting file extensions. – Dave Sherohman Oct 28 '08 at 23:33
How is trusting the content type, or file extension, any worse than trusting the header (first x bytes) of a file, which could also be forged. – Kibbee Oct 29 '08 at 01:26
The 2nd link is broken. – David Klempfner May 04 '22 at 01:31

score -1 · Answer 5 · answered Nov 21 '08 at 00:30

Reading the contents of the file is the fool proof way. Since you are building it in .Net, you could probably check the MIME Type of the uploaded file.

You can DllImport urlmon.dll to help. Please refer a post at: http://coding-passion.blogspot.com/2008/11/validating-file-type.html

And to clarify regarding Content-type, it invariably is driven by the extension of the file. So even a .zip file got its extension renamed to .txt, the content type will still say Text only.

How to check the content of an uploaded file without relying on its extension?

5 Answers5

Linked