你所不知道的文件上传更安全的类型判断

前言

在项目的实现过程中，大多数的前端在文件上传的的业务需求的实现过程中，就是简单的文件上传，也就是在表面上判断文件的后缀名来实现，例如：图片的校验，只需要判断后缀名为.jpeg、.jpg、.png等等，或者通过原生的html标签限制，如<input type="file" accept="image/*" />或者第三方的UI组件也是这个原理；其实我们都知道，这样的逻辑判断是没有什么问题，也没有任何逻辑问题，这只是在常规的情况下，如果一个黑客，当然不会用常规的方法去处理，比如修改文件的后缀名，这样我们上述的方法就是形同虚设，没有任何做拦截作用直接上传的服务器，如果只是一个普通的文件，造成不了任何损失，最多损失服务器的存储空间，如果这个文件携带一个病毒或者木马，这样这个服务器就是处于一个肉鸡啦。我们要如何去处理这样的一个情况下呢？

分析

我们都知道文件就是一个二进制流构成的，所以我们通过这种方式去分析每个文件的规则，接下来我们以几种图片来看，如果你想如何查看一个文件的二进制流信息，欢迎评论区留言，我告诉你如何做！

结果

由上面的几个图片分析我们就可以大概推出，图片都有一个相同的规律，我们根据这个相同的规律，判断就可以实现，就算你该后缀名也没有用。下面的一张图是我爸jpg 改成 bmp的

实现

function getFileMimeType(file) {const map = { // 要判断格式的map'FFD8FFE0': 'jpg','89504E47': 'png','47494638': 'gif'}const reader = new FileReader()reader.readAsArrayBuffer(file)return new Promise((resolve, reject) => {reader.onload = (event) => {try {let char16Arry = new Uint8Array(event.target.result)char16Arry = char16Arry.slice(0, 4)const tempArr = [...char16Arry]const key = tempArr.map(item => item.toString(16).toUpperCase().padStart(2, '0')).join('')resolve(map[key])} catch (e) {reject(e)}}})
}

测试

附：常见文件的文件头标识

255044 PDF
526563 EML
D0CF11 PPT
4D5AEE COM
E93B03 COM
4D5A90 EXE
424D3E BMP
49492A TIF
384250 PSD
C5D0D3 EPS
0A0501 PCS
89504E PNG
060500 RAW
000002 TGA
60EA27 ARJ
526172 RAR
504B03 ZIP
495363 CAB
1F9D8C Z
524946 WAV
435753 SWF
3026B2 WMV
3026B2 WMA
2E524D RM
00000F MOV
000077 MOV
000001 MPA
FFFB50 MP3
234558 m3u
3C2144 HTM
FFFE3C XSL
3C3F78 XML
3C3F78 MSC
4C0000 LNK
495453 CHM
805343 scm
D0CF11 XLS
31BE00 WRI
00FFFF MDF
4D4544 MDS
5B436C CCD
00FFFF IMG
FFFFFF SUB
17A150 PCB
2A5052 ECO
526563 PPC
000100 DDB
42494C LDB
2A7665 SCH
2A2420 LIB
434841 FNT
7B5C72 RTF
7B5072 GTD
234445 PRG
000007 PJT
202020 BAS
000002 TAG
4D5A90 dll
4D5A90 OCX
4D5A50 DPL
3F5F03 HLP
4D5A90 OLB
4D5A90 IMM
4D5A90 IME
3F5F03 LHP
C22020 NLS
5B5769 CPX
4D5A16 DRV
5B4144 PBK
24536F PLL
4E4553 NES
87F53E GBC
00FFFF SMD
584245 XBE
005001 XMV
000100 TTF
484802 PDG
000100 TST
414331 dwg
D0CF11 max

另外还有一些重要的文件，没有固定的文件头，如下：

TXT 没固定文件头定义
TMP 没固定文件头定义
INI 没固定文件头定义
BIN 没固定文件头定义
DBF 没固定文件头定义
C 没没固定文件头定义
CPP 没固定文件头定义
H 没固定文件头定义
BAT 没固定文件头定义

还有一些不同的文件有相同的文件头，最典型的就是下面：

4D5A90 EXE
4D5A90 dll
4D5A90 OCX
4D5A90 OLB
4D5A90 IMM
4D5A90 IME

mmime type:

ime.ez=application/andrew-inset

mime.csm=application/cu-seeme

mime.cu=application/cu-seeme

mime.tsp=application/dsptype

mime.spl=application/futuresplash

mime.hta=application/hta

mime.cpt=application/mac-compactpro

mime.hqx=application/mac-binhex40

mime.nb=application/mathematica

mime.mdb=application/msaccess

mime.doc=application/msword

mime.dot=application/msword

mime.bin=application/octet-stream

mime.oda=application/oda

mime.ogg=application/ogg

mime.prf=application/pics-rules

mime.key=application/pgp-keys

mime.pdf=application/pdf

mime.pgp=application/pgp-signature

mime.ps=application/postscript

mime.ai=application/postscript

mime.eps=application/postscript

mime.rss=application/rss+xml

mime.rtf=application/rtf

mime.smi=application/smil

mime.smil=application/smil

mime.wp5=application/wordperfect5.1

mime.xht=application/xhtml+xml

mime.xhtml=application/xhtml+xml

mime.zip=application/zip

mime.cdy=application/vnd.cinderella

mime.mif=application/vnd.mif

mime.xls=application/vnd.ms-excel

mime.xlb=application/vnd.ms-excel

mime.cat=application/vnd.ms-pki.seccat

mime.stl=application/vnd.ms-pki.stl

mime.ppt=application/vnd.ms-powerpoint

mime.pps=application/vnd.ms-powerpoint

mime.pot=application/vnd.ms-powerpoint

mime.sdc=application/vnd.stardivision.calc

mime.sda=application/vnd.stardivision.draw

mime.sdd=application/vnd.stardivision.impress

mime.sdp=application/vnd.stardivision.impress

mime.smf=application/vnd.stardivision.math

mime.sdw=application/vnd.stardivision.writer

mime.vor=application/vnd.stardivision.writer

mime.sgl=application/vnd.stardivision.writer-global

mime.sxc=application/vnd.sun.xml.calc

mime.stc=application/vnd.sun.xml.calc.template

mime.sxd=application/vnd.sun.xml.draw

mime.std=application/vnd.sun.xml.draw.template

mime.sxi=application/vnd.sun.xml.impress

mime.sti=application/vnd.sun.xml.impress.template

mime.sxm=application/vnd.sun.xml.math

mime.sxw=application/vnd.sun.xml.writer

mime.sxg=application/vnd.sun.xml.writer.global

mime.stw=application/vnd.sun.xml.writer.template

mime.sis=application/vnd.symbian.install

mime.wbxml=application/vnd.wap.wbxml

mime.wmlc=application/vnd.wap.wmlc

mime.wmlsc=application/vnd.wap.wmlscriptc

mime.wk=application/x-123

mime.dmg=application/x-apple-diskimage

mime.bcpio=application/x-bcpio

mime.torrent=application/x-bittorrent

mime.cdf=application/x-cdf

mime.vcd=application/x-cdlink

mime.pgn=application/x-chess-pgn

mime.cpio=application/x-cpio

mime.csh=application/x-csh

mime.deb=application/x-debian-package

mime.dcr=application/x-director

mime.dir=application/x-director

mime.dxr=application/x-director

mime.wad=application/x-doom

mime.dms=application/x-dms

mime.dvi=application/x-dvi

mime.pfa=application/x-font

mime.pfb=application/x-font

mime.gsf=application/x-font

mime.pcf=application/x-font

mime.pcf.Z=application/x-font

mime.spl=application/x-futuresplash

mime.gnumeric=application/x-gnumeric

mime.sgf=application/x-go-sgf

mime.gcf=application/x-graphing-calculator

mime.gtar=application/x-gtar

mime.tgz=application/x-gtar

mime.taz=application/x-gtar

mime.hdf=application/x-hdf

mime.phtml=application/x-httpd-php

mime.pht=application/x-httpd-php

mime.php=application/x-httpd-php

mime.phps=application/x-httpd-php-source

mime.php3=application/x-httpd-php3

mime.php3p=application/x-httpd-php3-preprocessed

mime.php4=application/x-httpd-php4

mime.ica=application/x-ica

mime.ins=application/x-internet-signup

mime.isp=application/x-internet-signup

mime.iii=application/x-iphone

mime.jar=application/x-java-archive

mime.jnlp=application/x-java-jnlp-file

mime.ser=application/x-java-serialized-object

mime.class=application/x-java-vm

mime.js=application/x-javascript

mime.chrt=application/x-kchart

mime.kil=application/x-killustrator

mime.kpr=application/x-kpresenter

mime.kpt=application/x-kpresenter

mime.skp=application/x-koan

mime.skd=application/x-koan

mime.skt=application/x-koan

mime.skm=application/x-koan

mime.ksp=application/x-kspread

mime.kwd=application/x-kword

mime.kwt=application/x-kword

mime.latex=application/x-latex

mime.lha=application/x-lha

mime.lzh=application/x-lzh

mime.lzx=application/x-lzx

mime.frm=application/x-maker

mime.maker=application/x-maker

mime.frame=application/x-maker

mime.fm=application/x-maker

mime.fb=application/x-maker

mime.book=application/x-maker

mime.fbdoc=application/x-maker

mime.mif=application/x-mif

mime.wmz=application/x-ms-wmz

mime.wmd=application/x-ms-wmd

mime.com=application/x-msdos-program

mime.exe=application/x-msdos-program

mime.bat=application/x-msdos-program

mime.dll=application/x-msdos-program

mime.msi=application/x-msi

mime.nc=application/x-netcdf

mime.pac=application/x-ns-proxy-autoconfig

mime.nwc=application/x-nwc

mime.o=application/x-object

mime.oza=application/x-oz-application

mime.pl=application/x-perl

mime.pm=application/x-perl

mime.p7r=application/x-pkcs7-certreqresp

mime.crl=application/x-pkcs7-crl

mime.qtl=application/x-quicktimeplayer

mime.rpm=application/x-redhat-package-manager

mime.shar=application/x-shar

mime.swf=application/x-shockwave-flash

mime.swfl=application/x-shockwave-flash

mime.sh=application/x-sh

mime.sit=application/x-stuffit

mime.sv4cpio=application/x-sv4cpio

mime.sv4crc=application/x-sv4crc

mime.tar=application/x-tar

mime.tcl=application/x-tcl

mime.tex=application/x-tex

mime.gf=application/x-tex-gf

mime.pk=application/x-tex-pk

mime.texinfo=application/x-texinfo

mime.texi=application/x-texinfo

mime.~=application/x-trash

mime.%=application/x-trash

mime.bak=application/x-trash

mime.old=application/x-trash

mime.sik=application/x-trash

mime.t=application/x-troff

mime.tr=application/x-troff

mime.roff=application/x-troff

mime.man=application/x-troff-man

mime.me=application/x-troff-me

mime.ms=application/x-troff-ms

mime.ustar=application/x-ustar

mime.src=application/x-wais-source

mime.wz=application/x-wingz

mime.crt=application/x-x509-ca-cert

mime.fig=application/x-xfig

mime.au=audio/basic

mime.snd=audio/basic

mime.mid=audio/midi

mime.midi=audio/midi

mime.kar=audio/midi

mime.mpga=audio/mpeg

mime.mpega=audio/mpeg

mime.mp2=audio/mpeg

mime.mp3=audio/mpeg

mime.m3u=audio/mpegurl

mime.sid=audio/prs.sid

mime.aif=audio/x-aiff

mime.aiff=audio/x-aiff

mime.aifc=audio/x-aiff

mime.gsm=audio/x-gsm

mime.m3u=audio/x-mpegurl

mime.wma=audio/x-ms-wma

mime.wax=audio/x-ms-wax

mime.rpm=audio/x-pn-realaudio-plugin

mime.ra=audio/x-pn-realaudio

mime.rm=audio/x-pn-realaudio

mime.ram=audio/x-pn-realaudio

mime.ra=audio/x-realaudio

mime.pls=audio/x-scpls

mime.sd2=audio/x-sd2

mime.wav=audio/x-wav

mime.pdb=chemical/x-pdb

mime.xyz=chemical/x-xyz

mime.bmp=image/bmp

mime.gif=image/gif

mime.ief=image/ief

mime.jpeg=image/jpeg

mime.jpg=image/jpeg

mime.jpe=image/jpeg

mime.pcx=image/pcx

mime.png=image/png

mime.svg=image/svg+xml

mime.svgz=image/svg+xml

mime.tiff=image/tiff

mime.tif=image/tiff

mime.wbmp=image/vnd.wap.wbmp

mime.ras=image/x-cmu-raster

mime.cdr=image/x-coreldraw

mime.pat=image/x-coreldrawpattern

mime.cdt=image/x-coreldrawtemplate

mime.cpt=image/x-corelphotopaint

mime.djvu=image/x-djvu

mime.djv=image/x-djvu

mime.ico=image/x-icon

mime.art=image/x-jg

mime.jng=image/x-jng

mime.bmp=image/x-ms-bmp

mime.psd=image/x-photoshop

mime.pnm=image/x-portable-anymap

mime.pbm=image/x-portable-bitmap

mime.pgm=image/x-portable-graymap

mime.ppm=image/x-portable-pixmap

mime.rgb=image/x-rgb

mime.xbm=image/x-xbitmap

mime.xpm=image/x-xpixmap

mime.xwd=image/x-xwindowdump

mime.igs=model/iges

mime.iges=model/iges

mime.msh=model/mesh

mime.mesh=model/mesh

mime.silo=model/mesh

mime.wrl=model/vrml

mime.vrml=model/vrml

mime.csv=text/comma-separated-values

mime.css=text/css

mime.323=text/h323

mime.htm=text/html

mime.html=text/html

mime.uls=text/iuls

mime.mml=text/mathml

mime.asc=text/plain

mime.txt=text/plain

mime.text=text/plain

mime.diff=text/plain

mime.rtx=text/richtext

mime.rtf=text/rtf

mime.sct=text/scriptlet

mime.wsc=text/scriptlet

mime.tm=text/texmacs

mime.ts=text/texmacs

mime.tsv=text/tab-separated-values

mime.jad=text/vnd.sun.j2me.app-descriptor

mime.wml=text/vnd.wap.wml

mime.wmls=text/vnd.wap.wmlscript

mime.xml=text/xml

mime.xsl=text/xml

mime.h++=text/x-c++hdr

mime.hpp=text/x-c++hdr

mime.hxx=text/x-c++hdr

mime.hh=text/x-c++hdr

mime.c++=text/x-c++src

mime.cpp=text/x-c++src

mime.cxx=text/x-c++src

mime.cc=text/x-c++src

mime.h=text/x-chdr

mime.csh=text/x-csh

mime.c=text/x-csrc

mime.java=text/x-java

mime.moc=text/x-moc

mime.p=text/x-pascal

mime.pas=text/x-pascal

mime.***=text/x-pcs-***

mime.shtml=text/x-server-parsed-html

mime.etx=text/x-setext

mime.sh=text/x-sh

mime.tcl=text/x-tcl

mime.tk=text/x-tcl

mime.tex=text/x-tex

mime.ltx=text/x-tex

mime.sty=text/x-tex

mime.cls=text/x-tex

mime.vcs=text/x-vcalendar

mime.vcf=text/x-vcard

mime.dl=video/dl

mime.fli=video/fli

mime.gl=video/gl

mime.mpeg=video/mpeg

mime.mpg=video/mpeg

mime.mpe=video/mpeg

mime.qt=video/quicktime

mime.mov=video/quicktime

mime.mxu=video/vnd.mpegurl

mime.dif=video/x-dv

mime.dv=video/x-dv

mime.lsf=video/x-la-asf

mime.lsx=video/x-la-asf

mime.mng=video/x-mng

mime.asf=video/x-ms-asf

mime.asx=video/x-ms-asf

mime.wm=video/x-ms-wm

mime.wmv=video/x-ms-wmv

mime.wmx=video/x-ms-wmx

mime.wvx=video/x-ms-wvx

mime.avi=video/x-msvideo

mime.movie=video/x-sgi-movie

mime.ice=x-conference/x-cooltalk

mime.vrm=x-world/x-vrml

mime.vrml=x-world/x-vrml

mime.wrl=x-world/x-vrml