Prompt about attributes postedfile. contenttype of the fileupload control in ASP. NET

The postedfile. contenttype attribute is usually used to determine the MIME type of the uploaded file. We usually reject some types of uploads, such as only allowing the upload of image files. However, this attribute is actually unstable:

 

MIME types are not uniform

If we want to only allow the upload of JPG files, we usually determine whether the contenttype of the uploaded file is "image/JPEG". If it is not, it will be rejected. It looks very simple, however, in fact, this website does not have any problems when browsing and using chrome, but when using IE (IE8 for testing) to upload JPG files, it will be rejected. After debugging, it is found that the contenttype during ie upload is "image/pjpeg ".

This is only limited to two browsers and one file format. If there are multiple file formats in multiple browsers, It is a headache to consider both formats.

In my simple tests, I found other differences:

• The contenttype submitted by chrome for PNG files is image/PNG, while that submitted by IE for image/X-PNG
• The contenttype submitted by chrome for zip, rar, MSI, and other files is null, which can be correctly obtained by IE.

 

Low reliability and security

From the last question, it is easy to figure out that the MIME type is determined by the client.

Since it is a client, it is untrusted, because users can use non-mainstream browsers or maliciousProgram.

For example, if you impersonate an executable file as the mime of an image and cheat the server in checking it, it is very dangerous if you keep the extension of the original file while storing it on the server.

(For example, if an aspx file is uploaded by spoofing, then it can be directly executed by accessing its URL)

 

Conclusion

In addition to this attribute, there is still no better way to obtain the real type of the uploaded file, so you can only continue to use it, but remember that you need to work hard on compatibility and security, otherwise, it will be very depressing.