通过文件扩展名验证文件的真实性
有没有一种方法可以根据文件扩展名验证文件是否是其声称的内容？
我的应用程序将大量文件复制到远程服务器。在进行每个文件复制之前，我想验证该文件实际上是文件扩展名声称的内容。
现在，用户使用 NSOpenPanel 选择文件和/或文件目录。一旦我有了一组文件，我就可以在复制开始之前验证每个文件是否实际存在。我验证了源目录可写工作正常，并且使用 FSCopyObjectAsync 并取消所有文件的副本也工作正常。
最后一部分是验证检查。我的用户可以上传的内容受到限制，但过滤器是使用文件扩展名完成的。例如，恶意用户可能会获取一个 Word 文档文件（文件扩展名为 .doc）并将其更改为 .png，以使其通过初始打开的对话框验证。
这是一个相当简单的例子。这些文件由服务器使用，我只是想确保不会上传不起作用的文件。
我查看了 NSFileManager attributeOfItems:atPath:，但它似乎没有提供真实文件类型的任何信息。文件类型仅返回目录、符号链接等的文件类型。
我不想尝试打开并加载每个文件进行验证，只需读取文件头并检查它是否符合所需的任何文件类型规范。
这不是 iOS 应用程序。
非常感谢任何和所有正确方向的帮助或指示。
Is there a way to validate a file is what it claims to be according to it's file extension?
I have a large number of files that my application copies to a remote server. Before doing each file copy I would like to validate that the file is in fact what the file extension claims it to be.
Right now the user selects the files and/or directories of files using NSOpenPanel. Once I have an array of files I can validate each one physically exists before the copy commences. I have the validation that the source directory is writable working fine and a copy using FSCopyObjectAsync with all the file cancellation in place is also working fine.
The last piece is this validation check. My users are limited in what they can upload, but the filter is done using the file extension. A malicious user could, for example, take a word document file (.doc by file extension) and change it to a .png in order for it to pass the initial open dialog box validation.
This is a rather simplistic example. The files are utilized by the server and I just want to make sure that files that won't work don't get uploaded.
I looked at NSFileManager attributeOfItems:atPath:, but it doesn't seem to offer any information for the real file type. The file type only returns that of a directory, symbolic link etc.
I would rather not attempt to open and load every file to validate, just read the file header and check it conforms to whatever file type spec it needs to.
This is not an iOS app.
Any and all help or pointers in the right direction much appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以使用 libmagic 或 MagicKit，它是 libmagic 的 Objective-C 包装器。 MagicKit 可以返回给定文件的 UTI 或 MIME 类型。
You could use libmagic or MagicKit, an Objective-C wrapper around libmagic. MagicKit can return the UTI or the MIME type of a given file.
您可以尝试在其上运行
/usr/bin/file --mime来获取 MIME 类型。You could try running
/usr/bin/file --mimeon it to get a MIME type.基本上，没有。文件系统只知道有关文件的一些非常有限的信息。可能还有更多相关的元数据，但在许多情况下不会有——而且在任何情况下，元数据都可能撒谎。如果您想确定文件确实包含其声明的内容，则需要打开它并查看。
根据文件类型和信任级别，您可能不必查看整个内容。例如，文件的第一个字节可能有一个幻数，或者可能有其他足以说服您的标头信息。但它们的存在并不能保证该文件能够“工作”。
Basically, no. The file system only knows a few very limited things about a file. There can be further metadata associated, but in many cases there won't be -- and in any case, metadata can lie. If you want to be certain that a file really contains what it claims, you need to open it and look.
Depending on the file type and level of trust, you may not have to look at the whole thing. For example, the file may have a magic number in its first bytes, or there may be other header info that's enough to convince you. But their presence does not guarantee that the file will "work".