Can I reliably figure out the correct mime type to serve untrusted content?

Question

Say I let users upload files to my server, and I let users download them. I'd like to set the mime type to something other than just application/octet-stream, so that if the browser can just open them, it does (say, for images, pdf files, plain text files, etc.) Of course, since the files are uploaded by users, I can't trust the file extension, etc.

Is there a good library for figuring out what mime type goes with an arbitrary blob? Preferably usable from Python :-)

Thanks!

Answer 1

Try python-magic.

Answer 2

Beware of text files: there's no way of knowing what encoding they're in, and there's no reliable way of guessing, especially since most ones created in Windows are in 8-bit MBCS encodings which are indistinguishable without language heuristics. You need to know the encoding--not just the MIME type--to set the complete Content-Type for a file to be viewable in a browser. If you want to allow uploading and displaying text, it's much safer to use an HTML text form than a raw file upload.

Also, note that a file can be multiple file types; for example, self-extracting ZIPs are both valid Windows executables and ZIP files, and can be treated as either.