Effective policy of preventing trojans when uploading images using ASP. NET (C #)

I searched other people's solutions online. Many people say that mime is used for judgment. I also tried it myself. If I use the. NET Upload Component, I do. However, the basic HTML Upload Component does not work (I have an upload component in the HTML page and post it to another page in the background ). So I wrote a piece of code to check whether the uploaded file is an image file.

The first two steps are preliminary checks (of course, JavaScript is used on the front-end to check the client Extension). If you use the image class check, you can pass the check if it is a real image, otherwise it won't work (tested)

 

Code Protected bool isvalidimage (system. Web. httppostedfile postedfile)
{
String smimetype = postedfile. contenttype. tolower ();

If (smimetype. indexof ("image/") <0)
Return false;
If (postedfile. contentlength <50)
Return false;
Try
{
System. Drawing. Image IMG = system. Drawing. image. fromstream (postedfile. inputstream );
If (IMG. Width * IMG. height <1)
Return false;
IMG. Dispose ();
}
Catch
{
Return false;
}
Return true;
}