FileUpload控件上传文件时不应该

Question

I have a file upload form that uses FileUpload control in asp.net 4.0. On my upload button i check the file that is being submitted for some restrictions like this:

FileUpload fu = new FileUpload();

    if (fu.HasFile)
    {
        if ((extension == ".jpg") || (extension == ".png") || (extension == ".gif"))
        {
             if (fu.PostedFile.ContentLength <= 2MB)
             {
                 fu.SaveAs("path"); // save the file on the server
                 // check file header ...       
             }
         }
    }

The problem is that when i submit a video (which obviously has a different extension and size > 2MB) instead of checking this on the client and give the error i have set up, it uploads it and then the client receives the error. Problem is what if the client submits a 1GB file?! I mean, how does it pass from extension and size validation to SaveAs(), i can't understand. Any opinions? Thanks!

Answer 1

Unfortunately, that code runs on the server, which means it can only do those checks after the file has been uploaded.

If the user attempts to upload a very large file, the request length limits (defined in web.config) will catch it, and the upload will be aborted once the limit is reached.

Other than that, you really do have to check the file on the server; and you should check more than just the extension. Someone could easily change the extension of a file to something else. That may or may not be an actual problem - but most likely is! (if nothing else, subsequent website users would see broken image placeholders when the browser tries to load a Word document as if it were an image, for example)

Answer 2

if you are using html5 then you can use FileReader. FileReader Javascript

1. You can validate from client side for size, content type.
2. once it get validated, you can post it to the server.

code taken from : FileReader Javascript

<script>
  function handleFileSelect(evt) {
    var files = evt.target.files; // FileList object

    // files is a FileList of File objects. List some properties.
    var output = [];
    for (var i = 0, f; f = files[i]; i++) {
      output.push('<li><strong>', escape(f.name), '</strong> (', f.type || 'n/a', ') - ',
                  f.size, ' bytes, last modified: ',
                  f.lastModifiedDate ? f.lastModifiedDate.toLocaleDateString() : 'n/a',
                  '</li>');
    }
    document.getElementById('list').innerHTML = '<ul>' + output.join('') + '</ul>';
  }

  document.getElementById('files').addEventListener('change', handleFileSelect, false);
</script>

polyfills for filereader

1. Filereader polyfill
2. Browser Support.

Answer 3

IS this your actual code? What is 2MB? It's not a string or an integer. I'm surprised it even compiled. You should have something like this:

 int iFileSize = file.ContentLength;


    if (iFileSize > 1000000)  // 1MB approx (actually less though)
    {
        // File is too big so do something here
        return;
    }