在Django中按内容类型验证文件的更好方法

Question

So i have implement the snippet hosted below:

https://djangosnippets.org/snippets/1303/

here is my code so far:

models.py

class Vehicle(models.Model):
    pub_date = models.DateTimeField('Date Published', auto_now_add=True)
    make = models.CharField(max_length=200)
    model = models.CharField(max_length=200)
    picture = models.FileField(upload_to='picture')

    def __unicode__(self):
        return self.title

    def get_absolute_url(self):
        return reverse('recipe_edit', kwargs={'pk': self.pk})

views.py

def vehicle_list(request, template_name='vehicle/vehicle_list.html'):
    if request.POST:
        form = VehicleForm(request.POST, request.FILES)
        if form.is_valid():
            form.save()
            return redirect('vehicle_list')
    else:
        form = VehicleForm()  # Create empty form

    vehicles = Vehicle.objects.all()  # Retrieve all vehicles from DB
    return render(request, template_name, {
        'vehicles': vehicles,
        'form': form
    },context_instance=RequestContext(request))

forms.py

class VehicleForm(forms.ModelForm):
    class Meta:
        model = Vehicle

    def clean_picture(self):
        content = self.cleaned_data['picture']
        content_type = content.content_type.split('/')[0]
        if content_type in settings.CONTENT_TYPES:
            if content.size > settings.MAX_UPLOAD_SIZE:
                raise forms.ValidationError('Please keep file size under %s', filesizeformat(content.size))
        else:
            raise forms.ValidationError('File type is not supported')

From what i understand, this approach can still easily overridden by modifying the header. What i am asking is, whether there is a better approach for this situation?

Answer 1

In order to verify that the given file content matches the given content type by the client you need a full fledged database which describes how the content type can be detected.

You can rely on the libmagic project instead though. There are bindings for this library available on the pypi: python-magic

You need to adjust your VehicleForm so that it does the content type detection:

class VehicleForm(forms.ModelForm):

    class Meta(object):
        model = Vehicle

    def clean_picture(self):
        content = self.cleaned_data['picture']
        try:
            content.open()
            # read only a small chunk or a large file could nuke the server
            file_content_type = magic.from_buffer(content.read(32768),
                                                  mime=True)
        finally:
            content.close()

        client_content_root_type = content.content_type.split('/')[0]
        file_content_root_type = file_content_type.split('/')[0]

        if client_content_root_type in settings.CONTENT_TYPES and \
                file_content_root_type in settings.CONTENT_TYPES:
            if content.size > settings.MAX_UPLOAD_SIZE:
                raise forms.ValidationError('Please keep file size under %s',
                                            filesizeformat(content.size))
        else:
            raise forms.ValidationError('File type is not supported')
        return content

This chunk of code was written to show how it works, not with reducing redundant code in mind.

I wouldn't recommend doing this by yourself in production Code. I would recommend using already present code. I would recommend the ImageField form field if you really only need to verify that an image has been uploaded and can be viewed. Please notice that the ImageField uses Pillow to ensure that the image can be opened. This might or might not pose a threat to your server.

There are also several other projects available which exactly implements the desired feature of ensuring that a file of a certain content type has been uploaded.