Click here to Skip to main content
15,887,214 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
This is my code for uploading a file in a folder:
C#
if (FileUpload1.HasFile)
            {
                if (FileUpload1.PostedFile.ContentLength / 1024 > 2048)
                    throw new ApplicationException
                    ("Uploaded File Should less then 2MB");
                filename = FileUpload1.PostedFile.FileName;
                FileUpload1.SaveAs(Server.MapPath
                ("~/FILE_UPLOADS/ARREST_MEMO/ ") + (filename));
                Regex FilenameRegex;
                FilenameRegex = new Regex("(.*?)\\.(pdf)$", 
                                RegexOptions.IgnoreCase);
                if (!FilenameRegex.IsMatch(filename))
                    throw new ApplicationException("Browse PDF files Only");
            }


What I have tried:

I tried with this code in the button click event:
C#
try
            {
                filename = UpName.Value.ToString();
                filepath =
                type = System.IO.Path.GetExtension(filename);
                Byte[] bytes = Convert.FromBase64String(UpData.Value);
                //Response.Clear();
                //Response.ClearHeaders();
                Response.Buffer = true;
                Response.Charset = "";
                this.EnableViewState = false;
                Response.Cache.SetCacheability(HttpCacheability.NoCache);
                Response.ContentType = "Application/pdf";
                //Response.AddHeader("Content-Disposition", 
                                     "attachment;filename=" + filename);
                Response.AppendHeader("Content-Disposition", "attachment; 
                                 filename=" + Path.GetFileName(filepath));
                Response.TransmitFile(Server.MapPath(filepath));
                Response.BinaryWrite(bytes);
                Response.Flush();
                Response.End();
                HttpContext.Current.ApplicationInstance.CompleteRequest();
            }
Posted
Updated 4-Nov-23 5:01am
v2
Comments
Richard MacCutchan 2-Nov-23 5:07am    
What is the problem?
Richard Deeming 2-Nov-23 5:11am    
NB: The PostedFile.FileName property is entirely controlled by the client. A malicious user could send a request which would cause your code to save the uploaded file to any location of their choosing on your server, subject only to the file system permissions granted to your application's user.

Do not trust the FileName property. Validate it to ensure that it is not empty, and that it doesn't contain any characters which are not valid in a file name (Path.GetInvalidFileNameChars).
Richard Deeming 2-Nov-23 5:13am    
Also, you're validating the file extension after you've already saved the file. I could upload an exe file, and your code would save it before throwing an exception indicating that it's not valid.
Minaketan Behera 4-Nov-23 2:46am    
Thank You...Richard

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900