i'm currently developing a website where the user is able to upload a valid image and not any other file types for security purposes. Atm i have this code but the image extension could still be tampered.
if (extension == ".jpg" || extension == ".jpeg" || extension == ".JPG" || extension == ".gif" || extension == ".png"
Is there any way to make absolutely sure that only these image formats are allowed and that they cannot be altered (like a global code for each format). Thanks
Its better to check on contentType instead of extension.
You can find a pretty comprehensive list here: http://www.freeformatter.com/mime-types-list.html.
A simple check can be done in the following way:
if (myFile.ContentType == "video/mpeg")
{
// Do your thing
}
else{
// error
}
If you want to check for more, you can use this for example:
string[] filetypes = { "application/pdf", "image/jpeg", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "text/plain", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/vnd.ms-excel" };
if (!filetypes.Contains(myFile.File.ContentType))
{
//not accepted content type
}
And you can also check if its an valid image by trying to instantiate a new bitmap
try
{
using (var bitmap = new System.Drawing.Bitmap(myFile.InputStream))
{
}
}
catch (Exception)
{
return false;
}
