How to prevent exe file upload in asp.net mvc.
+2
A:
If you are trying to prevent users uploading dangerous content, preventing them to upload exe files isn't enough. This is a black list approach. Much better is to ask yourself what are the valid file types you do support and block all others. This is a white list.
To allow certain file types you can check for the extension, but perhaps also validate the file header (the first couple of bytes from a file) to detect whether it is actually of the type you expect. You will have to figure out for each file type what the possible headers are.
Good luck.
Steven
2010-09-03 11:16:48
but how to file extension.
andrew Sullivan
2010-09-03 11:24:50
The `Request.Files` property has a collection of `HttpPostedFileBase` instances. `HttpPostedFileBase` contains a `FileName` property that you can use. `System.IO.Path.GetExtension(string)` allows you to fetch the extension of a file.
Steven
2010-09-03 11:32:38