File validation while uploading file

Question

I am using two jars commons-fileupload-1.2.2.jar and commons-io-2.0.1.jar to upload a file in my form. I am able to upload the file, but my requirement is to upload only .jpg/.jpeg file only. Below is my code. the problem is that if i change the extension of a pdf file to jpg file, it gets upload.

Currently i am checking it using content type of the file, the content type of changed pdf(into jpg) is also image/jpeg. I am not able to validate it. Please help

if (ServletFileUpload.isMultipartContent(request)) {
            try {

                List<FileItem> multiparts = new ServletFileUpload(
                        new DiskFileItemFactory()).parseRequest(request);

                for (FileItem item : multiparts) {

                    if (!item.isFormField()) {

                        filename = new File(item.getName()).getName();
                        content = item.getContentType();
                        System.out.println("content type: " + content);
                        System.out.println("name: " + filename);
                        sizeInBytes = item.getSize();


                        item.write(new File(UPLOAD_DIRECTORY + File.separator + filename));


                    }


                }

                if (!content.contains("jpeg")) {
                    System.out.println("Please upload jpeg file");

                } else {
                   // fupload = true;
                }



        } else {

            response.sendRedirect("upload.jsp");
        }

score 0 · Answer 1 · answered May 21 '14 at 09:00

0

by the time you are doing it on the servlet it is too late, it is already uploaded. All you can do is check that the name ends with .jpg etc. Why not use <input type="file" accept="image/*">

answered May 21 '14 at 09:00

Scary Wombat

44,617
6
35
64

but when i rename a pdf file to jpg, for example a.pdf to a.jpg, the code accepts the file. – anonymous May 21 '14 at 09:01
whats wrong with `accept='image/jpeg`. Also have a look at http://stackoverflow.com/questions/51438/getting-a-files-mime-type-in-java – Scary Wombat May 22 '14 at 00:01
if i rename a pdf file to jpg, "accept='image/jpeg'" accepts that pdf file, which is wrong as it is a kind of attack. – anonymous May 22 '14 at 03:38
so did you look at the link I sent you? – Scary Wombat May 22 '14 at 04:12

File validation while uploading file

1 Answers1