How to restrict user from uploading malicious file to the application

Sidhartha Prusty

6y1.4k.NET

I have an ASP.NET MVC application where user can upload jpeg, png, gif, jpg files. How to restrict user to upload malicious files?

I am restricting the file upload on the basis of the file extension. However, If there is a malicious file 'filenam.html' and the user tries to upload it by changing the file name to 'filename.html.png', the application allows users to do so.

Please suggest how can I restrict the user from uploading malicious files from backend and frontend validation.

Note: I can not restrict the filenames on basis of multiple dots present in it as a valid file name can contain 'filename V1.1.png'

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Varun Setia6y ago
This was sample, you can try this based on your content type of your required formats
Laxmidhar Sahoo6y ago
Hi

Check the MEME type ,I am not sure ,but may help

https://stackoverflow.com/questions/18299806/how-to-check-file-mime-type-with-javascript-before-upload/29672957

Thanks and regards
Sidhartha Prusty6y ago
@Varun,

The ContentType still shows as "image/jpeg" for the file "filename.html.jpeg". So this solution will not work
Varun Setia6y ago
Hi,

Try restricting based on content type
HttpFileCollection MyFileCollection = Request.Files;

for (int Loop1 = 0; Loop1 < MyFileCollection.Count; Loop1++)
{
    if (MyFileCollection[Loop1].ContentType == "image/jpeg")
    {
       //...
    }
}