How can I determine a file’s true extension/type programmatically?

by

Not really, no.

You will need to read the first few bytes of each file and interpret it as a header for a finite set of known filetypes. Most files have distinct file headers, some sort of metadata in the first few bytes or first few kilobytes in the case of MP3.

Your program will have to simply try parsing the file for each of your accepted filetypes.

For my program, I send the uploaded image to imagemagick in a try-catch block, and if it blows up, then I guess it was a bad image. This should be considered insecure, because I am loading arbitrary (user supplied) binary data into an external program, which is generally an attack vector. here, I am trusting imageMagick to not do anything to my system.

I recommend writing your own handlers for the significant filetypes you intend to use, to avoid any attack vectors.

Edit: I see in PHP there are some tools to do this for you.

Also, MIME types are what the user’s browser claims the file to be. It is handy and useful to read those and act on them in your code, but it is not a secure method, because anyone sending you bad files will fake the MIME headers easily. It’s sort of a front line defense to keep your code that expects a JPEG from barfing on a PNG, but if someone embedded a virus in a .exe and named it JPEG, there’s no reason not to have spoofed the MIME type.

More Related Contents:

  1. Full Secure Image Upload Script
  2. php file upload, how to restrict file upload type
  3. Secure User Image Upload Capabilities in PHP
  4. How Secure Is This Login System? (Using Cookies In PHP)
  5. Why would $_FILES be empty when uploading files to PHP?
  6. What are the best practices for avoiding xss attacks in a PHP site [closed]
  7. When should I use prepared statements?
  8. “Keep Me Logged In” – the best approach
  9. How safe are PHP session variables?
  10. Generating a random password in php
  11. Check file extension in upload form in PHP [duplicate]
  12. What does it mean to escape a string?
  13. Preventing session hijacking
  14. Why is using a mysql prepared statement more secure than using the common escape functions?
  15. Are mysql_real_escape_string() and mysql_escape_string() sufficient for app security?
  16. “slash before every quote” problem [duplicate]
  17. How to create a laravel hashed password
  18. Check file size before upload
  19. Hiding true database object ID in url’s
  20. CodeIgniter – why use xss_clean
  21. $_FILES field ‘tmp_name’ has no value on .JPG file extension
  22. Codeigniter multiple file upload messes file extension
  23. s3 direct upload restricting file size and type
  24. Session hijacking and PHP
  25. Upload multiple files in CodeIgniter
  26. Detecting file upload size on the client side?
  27. How to get the file path in html in PHP?
  28. How do I determine the extension(s) associated with a MIME type in PHP?
  29. Upload DOC or PDF using PHP
  30. Why is it considered bad practice to use “global” reference inside functions? [duplicate]

Leave a Comment