How to check original file mime type

Question

0.00/5 (No votes)

See more:

Mandiant was able to upload a document with filetype that is not allowed, bypassing current filters.
The file upload pages only checked the file extension to permit or deny the upload. This method ignores the actual content of the file and the potential danger posed to employees responsible for interacting with the content.

How to implement file header inspection to verify the content in the upload will be interpreted as an image regardless of the application used.

What I have tried:

Checked MIMETYPE and headers in javascript

Posted 18-Jan-17 2:35am

Member-515487

Updated 18-Jan-17 3:37am

Add a Solution

Comments

Richard MacCutchan 18-Jan-17 8:47am

You can never guarantee that a file is the correct type, even after inspecting its contents. Some files contain specific header identifiers that you can look for, but any other file may contain the same sequence. Accept that the user (mostly) knows what they are doing, and leave it at that.

F-ES Sitecore 18-Jan-17 9:47am

You've just learned why javascript validation is a nice-to-have but server validation is mandatory.

Member-515487 19-Jan-17 1:25am

How can closed this security defect
i am checking on client side extension also server side
is there any other way to get it done

user uploading file after changing extension

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Jochen Arndt · Answer 1 · 2017-01-18T03:37:00

If only a few file types like images should be supported you can write a function checking for "magic bytes".

Such a function will usually read a fixed number of bytes from the beginning of the file and search for the magic bytes at file type specific positions.

The Linux file command provides such checks using a file named magic that defines the search patterns. This file can be used as starting point for your checks.

Some image file definitions:

0       string          \x89PNG\x0d\x0a\x1a\x0a         PNG image data
0       string          GIF8            GIF image data
0       beshort         0xffd8          JPEG image data
0       string          MM\x00\x2a      TIFF image data, big-endian
0       string          II\x2a\x00      TIFF image data, little-endian

The format is quite simple:
The first value is the offset, the second the data type, and the third the data (with strings using C style where \xNN indicates a hex byte and \NNN an octal byte).

Howerver, these checks might still fail.