如何以编程方式确定文件的真正扩展名/类型？ [英] How can I determine a file's true extension/type programatically?

问题描述

我正在处理用户上传到服务器的脚本，作为一个额外的安全层，我想知道：

有没有如何检测文件的真正的扩展名/文件类型，并确保它不是另一种文件类型用不同的扩展名掩盖？

是否有一个字节戳记或一些唯一标识符对于每个类型/扩展？

我希望能够检测到有人没有应用不同的扩展到他们正在上传的文件。

谢谢，

解决方案

$ b

您将需要读取每个文件的前几个字节，并将其解释为已知文件类型的有限集合的标头。大多数文件都有不同的文件标头，在前几个字节中有某种类型的元数据，或者在MP3的情况下，前几个字节是一些数据。

你的程序只需要简单地解析文件为您的每个接受的文件类型。

对于我的程序，我发送上传的图像imagemagick在try-catch块，如果它爆炸，那么我猜这是一个糟糕的形象。这应该被认为是不安全的，因为我正在将任意（用户提供的）二进制数据加载到外部程序中，这通常是一个攻击向量。在这里，我相信imageMagick不会对我的系统做任何事情。

我建议为您打算使用的重要文件类型编写自己的处理程序，以避免任何攻击媒介。

编辑：我在PHP中看到有一些工具可以帮助您。

另外，MIME类型是用户的浏览器要求的文件。在代码中阅读这些代码并对其采取行动是非常方便和有用的，但是这不是一种安全的方法，因为任何发送给你错误文件的人都会轻易地伪造MIME头文件。这是一个前线防线，以防止您的代码，以防止在PNG barfing，但如果有人在.exe中嵌入病毒，并命名为JPEG，没有理由不欺骗的MIME类型。

I am working on a script that will process user uploads to the server, and as an added layer of security I'd like to know:

Is there a way to detect a file's true extension/file type, and ensure that it is not another file type masked with a different extension?

Is there a byte stamp or some unique identifier for each type/extension?

I'd like to be able to detect that someone hasn't applied a different extension onto the file they are uploading.

Thank you,

解决方案

Not really, no.

You will need to read the first few bytes of each file and interpret it as a header for a finite set of known filetypes. Most files have distinct file headers, some sort of metadata in the first few bytes or first few kilobytes in the case of MP3.

Your program will have to simply try parsing the file for each of your accepted filetypes.

For my program, I send the uploaded image to imagemagick in a try-catch block, and if it blows up, then I guess it was a bad image. This should be considered insecure, because I am loading arbitrary (user supplied) binary data into an external program, which is generally an attack vector. here, I am trusting imageMagick to not do anything to my system.

I recommend writing your own handlers for the significant filetypes you intend to use, to avoid any attack vectors.

Edit: I see in PHP there are some tools to do this for you.

Also, MIME types are what the user's browser claims the file to be. It is handy and useful to read those and act on them in your code, but it is not a secure method, because anyone sending you bad files will fake the MIME headers easily. It's sort of a front line defense to keep your code that expects a JPEG from barfing on a PNG, but if someone embedded a virus in a .exe and named it JPEG, there's no reason not to have spoofed the MIME type.

这篇关于如何以编程方式确定文件的真正扩展名/类型？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！