I found two really good links talking about how to upload image file and validate file format in more secure way rather than just checking file extension.
- http://www.dotnetexpertguide.com/2011/05/validate-uploaded-image-content-in.html
- http://www.aaronstannard.com/post/2011/06/24/How-to-Securely-Verify-and-Validate-Image-Uploads-in-ASPNET-and-ASPNET-MVC.aspx
You should also check image file content before you try checking for header of image file.
I found both the articles have missed this code. Here is that missing code for validating file extension.
private Boolean CheckFileType()
{
string[] acceptedTypes = new string[]
{
"image/bmp",
"image/jpeg",
"image/gif",
"image/png"
};
if (!acceptedTypes.Contains(fuPhoto1.PostedFile.ContentType))
{
return false;
}
else
{
return true;
}
}
Note: This article is basically bookmark for my future reference.
No comments:
Post a Comment