tags:

views:

260

answers:

2

I'm developing a Web application that will let users upload images. My concern is the file´s size, specially if they are invalid formats.

I'm wondering if there´s a way in java (or a third party library) to check the allowed files formats (jpg, gif and png) before reading the entire file.

A: 

You don't need 3rd party libraries. The code you have to write is simple.

At the point you are handling your uploads, filter the files by their extension. This isn't perfect, but will account for most of the cases.

However, this would mean files are already uploaded to the server. You can use a bit of javascript on the client-side to perform the same operation - check whether the value of the file-upload component contains an allowed file type - .jpg, .png, etc.

Bozho
as you said this isn't going to be "perfect. I'm a bit concern about malicious user trying to upload a wrong file
Dani Cricco
@Dani Cricco you can't stop that. Even if there is a library that checks the headers of a file to see if it is a jpeg, the malicious users can fake these headers and do their things anyway. But these will be a rare case, trust me.
Bozho
I'm currently creating a BufferedImage with ImageIO.read. If the file is invalid then the ImageIO.red should fail. The problem is that I don't want to read the whole file into a BufferedImage, because it might be very big
Dani Cricco
@Dani: I don't have a good solution for your requirement (and your points are indeed valid), but ImageIO.read won't necessarily suffice either. ImageIO may accept malicious images and may also reject valid files. I've seen JPEG files with strange colour profiles, which are in theory correct, but are rejected by ImageIO in Java 5 and accepted in Java 6.
jarnbjo
+2  A: 

If you wish to support only a few types of images you can start by (up)loading the image and at some point use the first few bytes to check wether you wish to continue the upload.

Quite a lot of image formats can be recognized by the first few bytes, the magic number. If the number matches you don't know whether the file is valid of course, but it may be used to match extension and magic number to prevent is really does not correspond at all.

Have a look at this page to check out some Java which checks mime-types. Do read the docs or source to check whether any given method requires the entire file, or can operate on the first few bytes. I've not used those libraries :)

Also check out this page which also lists some java libraries, and some papers on which detection is based.

Don't forget to put in some feedback if you managed to find something you like!

extraneon
great tip! I'm going to check this. Please let me know if you find something relevant
Dani Cricco