提取文件頭簽名，因為它直接流式傳輸到 ASP.NET Core 中的磁盤

Question

我有一個 API 方法，可以將上傳的文件直接流式傳輸到磁盤，以便使用病毒檢查程序進行掃描。 其中一些文件可能非常大，因此 IFormFile 是不可行的：

任何超過 64 KB 的單個緩沖文件都會從內存移動到磁盤上的臨時文件。 來源： https : //docs.microsoft.com/en-us/aspnet/core/mvc/models/file-uploads?view=aspnetcore-3.1

我有一個使用 multipart/form-data 的工作示例和一個非常好的 NuGet 包，它消除了使用 multipart/form-data 時的頭痛，它運行良好，但是我想添加一個文件頭簽名檢查，以使確保客戶端定義的文件類型實際上是他們所說的。 我不能依靠文件擴展名來安全地執行此操作，但我可以使用文件頭簽名使其至少更安全一些。 由於我直接流式傳輸到磁盤，如何在它通過文件流時提取第一個字節？

[DisableFormValueModelBinding] // required for form binding
[ValidateMimeMultipartContent] // simple check to make sure this is a multipart form
[FileUploadOperation(typeof(SwaggerFileItem))] // used to define the Swagger schema
[RequestSizeLimit(31457280)] // 30MB
[RequestFormLimits(MultipartBodyLengthLimit = 31457280)]
public async Task<IActionResult> PostAsync([FromRoute] int customerId)
{
    // place holders
    var uploadLocation = string.Empty;
    var trustedFileNameForDisplay = string.Empty;

    // this is using a nuget package that does the hard work on reading the multipart form-data.... using UploadStream;
    var model = await this.StreamFiles<FileItem>(async x =>
    {
        // never trust the client
        trustedFileNameForDisplay = WebUtility.HtmlEncode(Path.GetFileName(x.FileName));

        // determien the quarantine location
        uploadLocation = GetUploadLocation(trustedFileNameForDisplay);

        // stream the input stream to the file stream
        // importantly this should never load the file into memory
        // it should be a straight pass through to disk
        await using var fs = System.IO.File.Create(uploadLocation, BufSize);
        
        // --> How do I extract the file signature? I.e. a copy of the header bytes as it is being streamed??? <--
        await x.OpenReadStream().CopyToAsync(fs);
    });

    // The model state can now be checked
    if (!ModelState.IsValid)
    {
        // delete the file
        DeleteFileIfExists(uploadLocation);

        // return a bad request
        ThrowProblemDetails(ModelState, StatusCodes.Status400BadRequest);
    }

    // map as much as we can
    var request = _mapper.Map<CreateAttachmentRequest>(model);

    // map the remaining properties
    request.CustomerId = customerId;
    request.UploadServer = Environment.MachineName;
    request.uploadLocation = uploadLocation;
    request.FileName = trustedFileNameForDisplay;

    // call mediator with this request to send it over WCF to Pulse Core.
    var result = await _mediator.Send(request);

    // build response
    var response = new FileResponse { Id = result.FileId, CustomerId = customerId, ExternalId = request.ExternalId };

    // return the 201 with the appropriate response
    return CreatedAtAction(nameof(GetFile), new { fileId = response.Id, customerId = response.customerId }, response);
}

我被困在這條線附近await x.OpenReadStream().CopyToAsync(fs); . 當流被復制到FileStream我想在這里拉出文件頭。 有沒有辦法添加某種檢查員？ 我不想再次閱讀整個流，只是標題。

更新

根據@Ackdari 給出的答案，我已成功切換代碼以從上傳的文件流中提取標頭。 我不知道這是否可以提高效率，但它確實有效：

//...... removed for clarity
var model = await this.StreamFiles<FileItem>(async x =>
{
    trustedFileNameForDisplay = WebUtility.HtmlEncode(Path.GetFileName(x.FileName));
    quarantineLocation = QuarantineLocation(trustedFileNameForDisplay);

    await using (var fs = System.IO.File.Create(quarantineLocation, BufSize))
    {
        await x.OpenReadStream().CopyToAsync(fs);

        fileFormat = await FileHelpers.GetFileFormatFromFileHeader(fs);
    }
});
//...... removed for clarity

和

// using https://github.com/AJMitev/FileTypeChecker
public static async Task<IFileType> GetFileFormatFromFileHeader(FileStream fs)
{
    IFileType fileFormat = null;
    fs.Position = 0;
    var headerData = new byte[40];
    var bytesRead = await fs.ReadAsync(headerData, 0, 40);
    if (bytesRead > 0)
    {
        await using (var ms = new MemoryStream(headerData))
        {
            if (!FileTypeValidator.IsTypeRecognizable(ms))
            {
                return null;
            }

            fileFormat = FileTypeValidator.GetFileType(ms);
        }
    }

    return fileFormat;
}

Answer 1

您可能需要考慮根據預期的文件類型自行閱讀標題

int n = 4; // length of header

var headerData = new byte[n];
var bytesRead = 0;
while (bytesRead < n)
    bytesRead += await x.ReadAsync(headerData.AsMemory(bytesRead));

CheckHeader(headerData);

await fs.WriteAsync(headerData.AsMemory());

await x.CopyToAsync(fs);