Java：从文件中检查内容类型和扩展名（mime）的最佳方法是什么？

Question

The most performant way to validate a file that I upload via an endpoint.

It should scan the bytes and not just compare the file extension.

I know this link that helps me, but I don't know if those is deprecated:

https://www.rgagnon.com/javadetails/java-0487.html

Thanks in advance!

Answer 1

There is not a 100% foolproof way to validate the content a file uploaded to an endpoint contains. This is because a file is at the end of the day is just bytes which may or may not hold information about the metadata of the file (eg. malicious user, corrupted file etc) The best you can do is an attempt to guess the type of the file.

You can use Apache Tika detection library as a dependency on your project. There is detailed documentation on how to do that in the link.

You can also utilise the Content-Type header from the HTTP request as an alternative way to detect the type of the file. At least this is what I would do, let any API consumers select the proper Content Type and perform an attempt to parse the file using the given Content Type (if supported that is). If an exception occurs then it's most likely that:

1. There is a bug in the parsing method you are using or
2. The Content-Type didn't match the actual content of the file.

Of course you can further limit what your endpoints accept by using content-specific annotations such as @Consumes(MediaType.APPLICATION_XML) but we are unable to provide any more help with the information provided.