如何在Javascript或Apex中检查受限文件

Question

While uploading file we need to validate whether the file is valid or restricted file by OWASP.

Allowed file types: txt,ppt,pptx,doc,docx,xls,xlsx,csv,jpeg,jpg,bmp,gif,png Restricted file types: exe,jar,zip,ini,log [executable files]

We have followed the below validations in javascript.

1. We are validating the files by file extension [ working fine ]
2. We are evaluating the file content by magic numbers[hex code] whether the file extension has been changed or not. it is perfectly working for most of the file types.

But the issue here is jar,odt,docx,pptx,ppt,xlsx files have same magic numbers.

We are not allowing user to upload executables files and zip,jar,odt files.

How to differentiate jar,odt & zip with docx,pptx,xlsx?

Reference Link:

https://en.wikipedia.org/wiki/List_of_file_signatures

https://medium.com/the-everyday-developer/detect-file-mime-type-using-magic-numbers-and-javascript-16bc513d4e1e

Please do let me know any solutions or suggestion to achieve this in Javascript or apex.

Answer 1

Fixed issue by reading the file content using FileReader API and checking whether the file contains [Content_Type.xml]. If the file is docx,xlsx or pptx it returns [content_type].xml while reading the file content from filereader. If it is a jar/odt/odc/apk or any other files it returns different string.