How do I Validate the File Type of a File Upload?

Question

I am using <input type="file" id="fileUpload" runat="server"> to upload a file in an ASP.NET application. I would like to limit the file type of the upload (example: limit to .xls or .xlsx file extensions).

Both JavaScript or server-side validation are OK (as long as the server side validation would take place before the files are being uploaded - there could be some very large files uploaded, so any validation needs to take place before the actual files are uploaded).

score 31 · Accepted Answer · answered Sep 16 '08 at 13:34

31

Seems like you are going to have limited options since you want the check to occur before the upload. I think the best you are going to get is to use javascript to validate the extension of the file. You could build a hash of valid extensions and then look to see if the extension of the file being uploaded existed in the hash.

HTML:

<input type="file" name="FILENAME"  size="20" onchange="check_extension(this.value,"upload");"/>
<input type="submit" id="upload" name="upload" value="Attach" disabled="disabled" />

Javascript:

var hash = {
  'xls'  : 1,
  'xlsx' : 1,
};

function check_extension(filename,submitId) {
      var re = /\..+$/;
      var ext = filename.match(re);
      var submitEl = document.getElementById(submitId);
      if (hash[ext]) {
        submitEl.disabled = false;
        return true;
      } else {
        alert("Invalid filename, please select another file");
        submitEl.disabled = true;

        return false;
      }
}

answered Sep 16 '08 at 13:34

Jamie

2,104
1
15
9

13

don't forget, this is only Client Side validation. I can still 'manually' HTTP-POST to the form url to bypass this check - you'll need to do a server side validation check also. – Pure.Krome May 07 '09 at 05:47
Just add those extension to the variable "hash". var hash = { 'xls' : 1, 'xlsx' : 1, 'doc' : 1, 'docx' : 1 }; – Jamie Apr 15 '10 at 22:14
2

this will return false when the filename contains extra .'s eg my.file.doc – Justin Moore Mar 17 '11 at 04:08
5

I used above but got the extension of the file using :'var ext = value.slice(value.lastIndexOf(".")).toLowerCase();' – Justin Moore Mar 17 '11 at 09:57
1

@Justin Moore: good solution, one change: var ext = value.slice(value.lastIndexOf(".") `+ 1`).toLowerCase(); – Alexander.Berg Sep 24 '12 at 14:57

score 27 · Answer 2 · edited Jun 22 '15 at 20:57

27

It's pretty simple using regulare expression validator.

<asp:RegularExpressionValidator
id="RegularExpressionValidator1"
runat="server"
ErrorMessage="Only zip file is allowed!"
ValidationExpression ="^.+(.zip|.ZIP)$"
ControlToValidate="FileUpload1"
> </asp:RegularExpressionValidator>

Client-Side Validation of File Types Permissible to Upload

edited Jun 22 '15 at 20:57

jlee-tessik

1,510
12
16

answered Jul 06 '10 at 17:59

shailesh

5,013
5
23
22

1

Regex is case-sensitive by default. You can disable that using (?i) for a group (as stated here -> http://www.exampledepot.com/egs/java.util.regex/Case.html). It won't work for Javascript, though (as stated here http://stackoverflow.com/questions/2641236/make-regular-expression-case-insensitive and tested personally by me). – marquito Oct 01 '12 at 14:37

score 6 · Answer 3 · answered Sep 16 '08 at 13:09

From javascript, you should be able to get the filename in the onsubmit handler. So in your case, you should do something like:

<form onsubmit="if (document.getElementById('fileUpload').value.match(/xls$/) || document.getElementById('fileUpload').value.match(/xlsx$/)) { alert ('Bad file type') ; return false; } else { return true; }">...</form>

score 6 · Answer 4 · answered Sep 16 '08 at 14:28

I agree with Chris, checking the extension is not validation of the type of file any way you look at it. Telerik's radUpload is probably your best option, it provides a ContentType property of the file being uploaded, which you can compare to known mime types. You should check for:

application/vnd.ms-excel,

application/excel,

application/x-msexcel

and for the new 2k7 format:

application/vnd.openxmlformatsofficedocument.spreadsheetml.sheet

Telerik used to sell radUpload as an individual component, but now its wrapped into the controls suite, which makes it a little more expensive, but by far its the easiest way to check for the true type

AlexWilson · Answer 5 · 2008-09-16T13:18:05.157

You could use a regular expression validator on the upload control:

  <asp:RegularExpressionValidator id="FileUpLoadValidator" runat="server" ErrorMessage="Upload Excel files only." ValidationExpression="^(([a-zA-Z]:)|(\\{2}\w+)\$?)(\\(\w[\w].*))(.xls|.XLS|.xlsx|.XLSX)$" ControlToValidate="fileUpload"> </asp:RegularExpressionValidator>

There is also the accept attribute of the input tag:

<input type="file" accept="application/msexcel" id="fileUpload" runat="server">

but I did not have much success when I tried this (with FF3 and IE7)

score 3 · Answer 6 · answered Jul 04 '13 at 11:01

Based on kd7's reply suggesting you check for the files content type, here's a wrapper method:

private bool FileIsValid(FileUpload fileUpload)
{
    if (!fileUpload.HasFile)
    {
        return false;
    }
    if (fileUpload.PostedFile.ContentType == "application/vnd.ms-excel" ||
        fileUpload.PostedFile.ContentType == "application/excel" ||
        fileUpload.PostedFile.ContentType == "application/x-msexcel" ||
        fileUpload.PostedFile.ContentType == "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" //this is xlsx format
        )
        return true;

    return false;
}

returning true if the file to upload is .xls or .xlsx

score 3 · Answer 7 · answered Sep 16 '08 at 14:03

3

As some people have mentioned, Javascript is the way to go. Bear in mind that the "validation" here is only by file extension, it won't validate that the file is a real excel spreadsheet!

answered Sep 16 '08 at 14:03

Jonathan Arkell

10,526
2
24
32

score 2 · Answer 8 · answered Dec 01 '08 at 11:23

2

Ensure that you always check for the file extension in server-side to ensure that no one can upload a malicious file such as .aspx, .asp etc.

answered Dec 01 '08 at 11:23

dr. evil

26,944
33
131
201

score 1 · Answer 9 · answered Feb 18 '10 at 09:59

1

As an alternative option, could you use the "accept" attribute of HTML File Input which defines which MIME types are acceptable.

Definition here

answered Feb 18 '10 at 09:59

chillysapien

2,256
1
26
42

score 1 · Answer 10 · answered Sep 16 '08 at 13:06

Well - you won't be able to do it server-side on post-back as the file will get submitted (uploaded) during the post-back.

I think you may be able to do it on the client using JavaScript. Personally, I use a third party component called radUpload by Telerik. It has a good client-side and server-side API, and it provides a progress bar for big file uploads.

I'm sure there are open source solutions available, too.

score 1 · Answer 11 · answered Sep 16 '08 at 13:18

I think there are different ways to do this. Since im not familiar with asp i can only give you some hints to check for a specific filetype:

1) the safe way: get more informations about the header of the filetype you wish to pass. parse the uploaded file and compare the headers

2) the quick way: split the name of the file into two pieces -> name of the file and the ending of the file. check out the ending of the file and compare it to the filetype you want to allow to be uploaded

hope it helps :)

score 1 · Answer 12 · answered Sep 16 '08 at 13:41

1

Avoid the standard Asp.Net control and use the NeadUpload component from Brettle Development: http://www.brettle.com/neatupload

Faster, easier to use, no worrying about the maxRequestLength parameter in config files and very easy to integrate.

answered Sep 16 '08 at 13:41

massimogentilini

4,102
5
29
32

Mark_fsg · Answer 13 · 2013-10-23T20:05:30.990

As another respondent notes, the file type can be spoofed (e.g., .exe renamed .pdf), which checking for the MIME type will not prevent (i.e., the .exe will show a MIME of "application/pdf" if renamed as .pdf). I believe a check of the true file type can only be done server side; an easy way to check it using System.IO.BinaryReader is described here:

http://forums.asp.net/post/2680667.aspx

and VB version here:

http://forums.asp.net/post/2681036.aspx

Note that you'll need to know the binary 'codes' for the file type(s) you're checking for, but you can get them by implementing this solution and debugging the code.

score 0 · Answer 14 · answered Jan 09 '19 at 16:58

Client Side Validation Checking:-

HTML:

<asp:FileUpload ID="FileUpload1" runat="server" />
<asp:Button ID="btnUpload" runat="server" Text="Upload" OnClientClick = "return ValidateFile()"  OnClick="btnUpload_Click"  />
<br />
<asp:Label ID="Label1" runat="server" Text="" />

Javascript:

<script type ="text/javascript">

    var validFilesTypes=["bmp","gif","png","jpg","jpeg","doc","xls"];

    function ValidateFile()

    {

      var file = document.getElementById("<%=FileUpload1.ClientID%>");

      var label = document.getElementById("<%=Label1.ClientID%>");

      var path = file.value;

      var ext=path.substring(path.lastIndexOf(".")+1,path.length).toLowerCase();

      var isValidFile = false;

      for (var i=0; i<validFilesTypes.length; i++)    
      {    
        if (ext==validFilesTypes[i])    
        {    
            isValidFile=true;    
            break;    
        }    
      }

      if (!isValidFile)    
      {    
        label.style.color="red";    
        label.innerHTML="Invalid File. Please upload a File with" +    
         " extension:\n\n"+validFilesTypes.join(", ");    
      }    
      return isValidFile;    
     }    
</script>

score 0 · Answer 15 · answered Sep 16 '08 at 13:09

Your only option seems to be client-side validation, because server side means the file was already uploaded. Also the MIME type is usually dictated by the file extension.

use a JavaScript Framework like jQuery to overload the onsubmit event of the form. Then check the extension. This will limit most attempts. However if a person changes an image to extension XLS then you will have a problem.

I don't know if this is an option for you, but you have more client side control when using something like Silverlight or Flash to upload. You may consider using one of these technologies for your upload process.

How do I Validate the File Type of a File Upload?

15 Answers15

Linked

Related