What is the best way to validate the file format in file-upload control in ASP.NET? Actually I want that user only upload files with specific format. Although I validate it by checking file name but I am looking for another solution to over come this.
-
Which formats do you plan to accept?Andomar– Andomar2011-07-09 21:03:59 +00:00Commented Jul 9, 2011 at 21:03
-
I want to Upload Packet tracer file .pktSMK– SMK2011-07-09 21:21:41 +00:00Commented Jul 9, 2011 at 21:21
Add a comment
|
3 Answers
Try the following code which reads the first 256 bytes from the file and return the mime type of the file using an internal dll (urlmon.dll).Then compare the mime type of your file and the returned mime type after parsing.
using System.Runtime.InteropServices; ...
[DllImport(@"urlmon.dll", CharSet = CharSet.Auto)]
private extern static System.UInt32 FindMimeFromData(
System.UInt32 pBC,
[MarshalAs(UnmanagedType.LPStr)] System.String pwzUrl,
[MarshalAs(UnmanagedType.LPArray)] byte[] pBuffer,
System.UInt32 cbSize,
[MarshalAs(UnmanagedType.LPStr)] System.String pwzMimeProposed,
System.UInt32 dwMimeFlags,
out System.UInt32 ppwzMimeOut,
System.UInt32 dwReserverd
);
public string getMimeFromFile(string filename)
{
if (!File.Exists(filename))
throw new FileNotFoundException(filename + " not found");
byte[] buffer = new byte[256];
using (FileStream fs = new FileStream(filename, FileMode.Open))
{
if (fs.Length >= 256)
fs.Read(buffer, 0, 256);
else
fs.Read(buffer, 0, (int)fs.Length);
}
try
{
System.UInt32 mimetype;
FindMimeFromData(0, null, buffer, 256, null, 0, out mimetype, 0);
System.IntPtr mimeTypePtr = new IntPtr(mimetype);
string mime = Marshal.PtrToStringUni(mimeTypePtr);
Marshal.FreeCoTaskMem(mimeTypePtr);
return mime;
}
catch (Exception e)
{
return "unknown/unknown";
}
}
But check the type in different browsers, since the mimetype might be different in different browsers.
Also this will give the exact mimetype even if you changed the extension by editing the name of the file.
Hope this helps you...
4 Comments
SMK
Sorry to say but iam looikng forward to validate from client.
Harun
@Shoaib, I too searched for some thing simillar as your requirement and can,t find one. Finally i just checked only for the extension at client-side and did the server-side validation for the purpose using the above code. urlmon.dll is an internal dll within dotnet library and only need to add its reference..
SMK
Thanx to All .I fond solution by simple using regular expression validator and check that my extension pattern should matched :)
Harun
@Shoaib, See, checking the file extension is simple. But if you upload an invalid file by changing its extension to the valid one by simply renaming it then your validation fails. If you added the mentioned server-side validation along with your client-side validation it will prevent uploading an invalid file by changing the extension. Now i hope you understand why this is done..
The only way to be sure is to actually parse the whole file according to the specification of the file format and check that everything fits.
If you want to do just basic check, most binary file formats have some form of header or magic number at their beginning, that you can check for.
