How to be sure that an uploaded file type is the real type, using IFormFile, without relying on extension or content type.

Question

Hi community,

I would like to know, because I've being search but without success, if is there a way to check the real file type on upload?
My scenario is, imagine that a user changes an executable file extension from ".exe" to ".jpg" or ".png", when he/she upload the file it looks like an image, and I'm only accepting these two types, but the file is a masked executable, is there a way to verify that?
Just to let you know, I already tried to check the first bytes, but when I changed the extension of the executable, I'm getting the bytes of a JPG or PNG, so it seems that it's not working.
Thank for those who will spend some time to help me!

Answer 1

https://learn.microsoft.com/en-us/aspnet/core/mvc/models/file-uploads?view=aspnetcore-7.0#file-signature-validation

Answer 2

Hi @Nuno Marques ,

My scenario is, imagine that a user changes an executable file extension from ".exe" to ".jpg" or ".png", when he/she upload the file it looks like an image, and I'm only accepting these two types, but the file is a masked executable, is there a way to verify that?

We can't verify that.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Dillion

Answer 3

to determine the file type you need to read and compare the format to known types. try this library:

https://github.com/AJMitev/FileTypeChecker