【100分】如何防范上传的图片包含恶意代码？？？求高手！！！
如题，
公司要实现一个鉴证图片上传的功能，
但要防止有人在图片中附加恶意代码，
目前有一些基本的想法，
但感觉还是不够可靠，
有没有人做过这个功能的？
赐教一二啊
[解决办法]
是为了防止php asp恶意程序伪装成图片么？
[解决办法]
后缀可以随意改
如果真的要去验证是否是真正的图片，感觉上最终得去验证图片的格式是否合法
这样肯定费劲
以前为了防止这样的事情，我一般不去计较他上传的是什么
不给它上传的目录执行的权限一般情况下就比较安全了
不知道楼主是更关注安全，还是更关注图片的真实性
[解决办法]
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
<title>无标题页</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:FileUpload ID="FileUpload1" runat="server" />
<asp:Button ID="btn_upload" runat="server" OnClick="btn_upload_Click" Text="上传" />
</div>
</form>
</body>
</html>
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void btn_upload_Click(object sender, EventArgs e)
{
Boolean fileOk = false;
string path = Server.MapPath("~/images/");
//判断是否已经选取文件
if (FileUpload1.HasFile)
{
//取得文件的扩展名,并转换成小写
string fileExtension = System.IO.Path.GetExtension (FileUpload1.FileName).ToLower();
//限定只能上传jpg和gif图片
string[] allowExtension = { ".jpg", ".gif" };
//对上传的文件的类型进行一个个匹对
for (int i = 0; i < allowExtension.Length; i++)
{
if (fileExtension == allowExtension[i])
{
fileOk = true;
break;
}
}
}
else
{
Response.Write("<script>alert(’你还没有选择文件’);</script>");
}
//如果扩展名符合条件，则上传
if (fileOk)
{
FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);
Response.Write("<script>alert(’上传成功’);</script>");
}
else
{
}
}
}
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void btn_upload_Click(object sender, EventArgs e)
{
try
{
//判断是否已经选取文件
if (FileUpload1.HasFile)
{
if (IsAllowedExtension(FileUpload1))
{
string path = Server.MapPath("~/images/");
FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);
Response.Write("<script>alert(’上传成功’);</script>");
}
else
{
Response.Write("<script>alert(’您只能上传jpg或者gif图片’);</script>");
}
}
else
{
Response.Write("<script>alert(’你还没有选择文件’);</script>");
}
}
catch (Exception error)
{
Response.Write(error.ToString());
}
}
//真正判断文件类型的关键函数
public static bool IsAllowedExtension(FileUpload hifile)
{
System.IO.FileStream fs = new System.IO.FileStream(hifile.PostedFile.FileName, System.IO.FileMode.Open, System.IO.FileAccess.Read);
System.IO.BinaryReader r = new System.IO.BinaryReader(fs);
string fileclass = "";
byte buffer;
try
{
buffer = r.ReadByte();
fileclass = buffer.ToString();
buffer = r.ReadByte();
fileclass += buffer.ToString();
}
catch
{
}
r.Close();
fs.Close();
if (fileclass == "255216"
[解决办法]
fileclass == "7173")//说明255216是jpg;7173是gif;6677是BMP,13780是PNG;7790是exe,8297是rar
{
return true;
}
else
{
return false;
}
}
}
/// <summary>
/// 文件编号
/// </summary>
public enum FileExtension
{
JPG = 255216,
GIF = 7173,
BMP = 6677,
PNG = 13780,
//RAR = 8297
// 255216 jpg;
// 7173 gif;
// 6677 bmp,
// 13780 png;
// 7790 exe dll,
// 8297 rar
// 6063 xml
// 6033 html
// 239187 aspx
// 117115 cs
// 119105 js
// 210187 txt
//255254 sql
}
public static class FileValidation
{
/// <summary>
/// 是否允许
/// </summary>
/// <param name="oFile"></param>
/// <param name="fileEx"></param>
/// <returns></returns>
public static bool IsAllowedExtension(HttpPostedFile oFile, FileExtension[] fileEx)
{
int fileLen = oFile.ContentLength;
byte[] imgArray = new byte[fileLen];
oFile.InputStream.Read(imgArray, 0, fileLen);
MemoryStream ms = new MemoryStream(imgArray);
System.IO.BinaryReader br = new System.IO.BinaryReader(ms);
string fileclass = "";
byte buffer;
try
{
buffer = br.ReadByte();
fileclass = buffer.ToString();
buffer = br.ReadByte();
fileclass += buffer.ToString();
}
catch { }
br.Close();
ms.Close();
foreach (FileExtension fe in fileEx)
{
if (Int32.Parse(fileclass) == (int)fe)
return true;
}
return false;
}
/// <summary>
/// 上传前的图片是否可靠
/// </summary>
/// <param name="oFile"></param>
/// <returns></returns>
public static bool IsSecureUploadPhoto(HttpPostedFile oFile)
{
bool isPhoto = false;
string fileExtension = System.IO.Path.GetExtension(oFile.FileName).ToLower();
string[] allowedExtensions = { ".gif", ".png", ".jpeg", ".jpg", ".bmp" };
for (int i = 0; i < allowedExtensions.Length; i++)
{
if (fileExtension == allowedExtensions[i])
{
isPhoto = true;
break;
}
}
if (!isPhoto) return true;//不是图片，既然允许上传，那就不检测了
FileExtension[] fe = {FileExtension.BMP,
FileExtension.GIF,
FileExtension.JPG,
FileExtension.PNG
};
if (IsAllowedExtension(oFile, fe))
return true;
else
return false;
}
/// <summary>
/// 上传后的图片是否安全
/// </summary>
/// <param name="photoFile">物理地址</param>
/// <returns></returns>
public static bool IsSecureUpfilePhoto(string photoFile)
{
bool isPhoto = false;
string Img = "Yes";
string fileExtension = System.IO.Path.GetExtension(photoFile).ToLower();
string[] allowedExtensions = { ".gif", ".png", ".jpeg", ".jpg", ".bmp" };
for (int i = 0; i < allowedExtensions.Length; i++)
{
if (fileExtension == allowedExtensions[i])
{
isPhoto = true;
break;
}
}
if (!isPhoto) return true;//不是图片，既然允许上传，那就不检测了
StreamReader sr = new StreamReader(photoFile, System.Text.Encoding.Default);
string strContent = sr.ReadToEnd();
sr.Close();
string str = "request
[解决办法]
<script
[解决办法]
.getfolder
[解决办法]
.createfolder
[解决办法]
.deletefolder
[解决办法]
.createdirectory
[解决办法]
.deletedirectory
[解决办法]
.saveas
[解决办法]
wscript.shell
[解决办法]
script.encode
[解决办法]
server.
[解决办法]
.createobject
[解决办法]
execute
[解决办法]
activexobject
[解决办法]
language=";
foreach (string s in str.Split('
[解决办法]
'))
if (strContent.ToLower().IndexOf(s) != -1)
{
File.Delete(photoFile);
Img = "No";
break;
}
return (Img == "Yes");
}
}
