Java中的分段文件上传检查MIME类型

Question

I am using mimeutil for checking the mimetype of a file. And only allowing csv and json files. But getting this mimetype for a json file "application/x-ipynb+json" mime type which is nowhere found. Any help will be appreciated to get the exact mime type of a file if also renamed a exe file to json which should not be allowed for security reasons. Refer below code for reference:

public static String verifyExtension(MultipartFile File){
String mimeType = null;
        MimeUtil.registerMimeDetector("eu.medsea.mimeutil.detector.MagicMimeMimeDetector");
        MimeUtil.registerMimeDetector("eu.medsea.mimeutil.detector.ExtensionMimeDetector");
        //MimeUtil.registerMimeDetector("eu.medsea.mimeutil.detector.OpendesktopMimeDetector");
        MimeUtil.registerMimeDetector(System.getProperty("os.name").startsWith(
              "Windows") ? "eu.medsea.mimeutil.detector.WindowsRegistryMimeDetector"
              : "eu.medsea.mimeutil.detector.OpendesktopMimeDetector");

        Collection<?> mimeTypes = null;
        try {
            mimeTypes = MimeUtil.getMimeTypes(File.getBytes());
            if(mimeTypes.equals("application/vnd.ms-excel") || mimeTypes.equals("application/json") 
                    || mimeTypes.equals("application/octet-stream"))
            {
                System.out.println("File typ is csv or json");
                mimeType = "success";
            }else{
                mimeType = "fail";
            }
        } catch (MimeException e1) {
            System.out.println(e1.getMessage());
            mimeType = "fail";
        } catch (IOException e1) {
            System.out.println(e1.getMessage());
            mimeType = "fail";
        }
}

Answer 1

Your issue is that MIME type checks in java are based on file extension.

In order to run actual file analysis try Apache Tika Mime Magic Detection .

Also, you can try one of the following:

1. ZIP the file before upload, then unzip on the server and test mime type
2. Upload through scalable 3rd party solution eg S3 bucket
3. Rename the uploaded file but send the file name in a header or URL parameter and test that for mime type