How do I tell if someone's faking a filetype?

Question

I'm programming something that allows users to store documents and pictures on a webserver, to be stored and retrieved later. When users upload files to my server, PHP tells me what filetype it is based on the extension. However, I'm afraid that users could rename a zip file as somezipfile.png and store it, thus keeping a zip file on my server. Is there any reasonable way to open an uploaded file and "check" to see if it truly is of the said filetype?

Answer 1

Magic number. If you can read first few bytes of a binary file you can know what kind of file it is.

Answer 2

Many filetypes have "magic numbers" at the beginning of the file to identify them, You can read some bytes from the front of the file and compare them to a list of known magic numbers.

Answer 3

For an exact answer on how you could quickly do this in PHP, check out this question: How do I find the mime-type of a file with php?

Answer 4

Check out the FileInfo PECL extension for PHP, which can do the MIME magic lookups for you.

Answer 5

As a side note I ran into a similar problem where I had to do my own type checking. The front end interface to my application was done in flash. The files were being passed through flash to a php script. When I was attempting to do a MIME type check using php the type always returned was application/octetstream because it was coming from flash.

I had to implement a magic numbers type paradigm. I simply created an xml file that held the file type along with some defining patterns found within the beginning of the file. Once the file reached the server I did some pattern matching with the xml file and then accepted or rejected the file. I didn't noticed any real performance decrease either which I was expecting.

This is just a side note to anyone who may be using flash as there front end and trying to type check the file once it is uploaded.

Answer 6

On a unix system, capturing the output from the 'file' command should provide adequate info.