What are the best practices to validate Image and upload in ASP.Net Core/EF Core?

Question

I have found some questions like Validate Image Type but it didn't fulfill my needs.
I have Model class named Movie which contains property

public byte[] Image { get; set; }

My View contains

<form asp-action="Index" method="post" enctype="multipart/form-data">
  <input asp-for="Image" type="file" id="files" class="form-control" />
  <input type="submit" value="Create" class="btn btn-default" />
</form>

and in controller, I am converting it to bytes and storing it in database. I want to validate it like, Files allowed .jpg, .jpeg, .png and max size of file 5Mb.

[HttpPost]
    public async Task<IActionResult> Index(Movie Movie, List<IFormFile> Image)
    {
        foreach(var item in Image)
        {
            if (item.Length > 0)
            {
                using (var stream = new MemoryStream())
                {
                    await item.CopyToAsync(stream);
                    Movie.Image = stream.ToArray();
                }
            }
        }
        _applicationDbContext.Movie.Add(Movie);
        _applicationDbContext.SaveChanges();
        return View();
    }

How can I validate the uploaded file ?

Please don't post screenshots of your code,rather post the code itself — Software Dev, Mar 25 '18 at 05:25
and why not check the filename(with extension) for known image extensions ?? — Software Dev, Mar 25 '18 at 05:26
and in order to check the size , take a look at [this](https://stackoverflow.com/questions/1380839/how-do-you-get-the-file-size-in-c)..I mean u can use `FileInfo.Length` and set an if condition,that's all(Note that `length` will return the file size in bytes,u may need to do the conversion) — Software Dev, Mar 25 '18 at 05:27
@lollmbaowtfidgafgtfoohwtbs NO, Just want to validate Image only to prevent it form File Upload Vulnerability. I want to validate it like, Files allowed *.jpg*, *.jpeg*, *.png* and _max size_ of file *5Mb*. — Fawad Bin Tariq, Mar 25 '18 at 06:25

score 1 · Answer 1 · answered Mar 25 '18 at 09:25

Every file has an extension and if it is a binary file, it has magic numbers in the header of the file that indicates what type of file it is, You can identify file type by reading the header of bytes.

Check this GitHub code
https://github.com/Muraad/Mime-Detective

file headers reference:
http://www.garykessler.net/library/file_sigs.html

mime types reference:
http://www.webmaster-toolkit.com/mime-types.shtml

What are the best practices to validate Image and upload in ASP.Net Core/EF Core?

1 Answers1