Click here to Skip to main content
15,885,546 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
How to restrict exe file upload after renaming the extension from exe to txt while asp.net file upload control.

What I have tried:

I have written the code at server side once file received but it will not solve the problem as file received at server end .
Posted
Updated 18-Jul-21 21:43pm

1 solution

You can't prevent the upload control from uploading a file based on it's content - as far as it's concerned, all files are just binary data, it doesn't care about the actual content. And ... text files are Unicode these days which use a wide spectrum of binary values, so it can be difficult to check if a file is "genuine text" or "binary data".

What you would have to do is check the file content at the backend: all EXE files start with the characters "MZ" and will generally contain a lot of null values so you could start by looking for that signature ...

But it probably won't help you: I don't know why you want to exclude EXE files specifically, but don;t forget it's pretty easy to ZIP them, translate them to Base64, encrypt them, or a combination of these methods. You probably need to think carefully about why you are trying to do this, and come up with a planned set of "permitted data" rather than trying to "ban" one class of file.
 
Share this answer
 
Comments
Richard Deeming 19-Jul-21 5:26am    
Technically, you can set the accept attribute on the control to one or more unique file type specifiers[^] to indicate which type(s) of file you want to upload.

But AFAIK, at least on Windows, the browser will base that decision on the file extension, rather than the "magic bytes".

And there's nothing to stop someone from using the browser's dev tools to remove that attribute. Or from using Postman to build the request manually, completely outside of the control of the site.

So as you say, server-side validation is the only option. :)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900