How to find the extension of a file in C#?

Question

In my web application (asp.net,c#) I am uploading video file in a page but I want to upload only flv videos. How can I restrict when I upload other extension videos?

Solution 1

Path.GetExtension

string myFilePath = @"C:\MyFile.txt";
string ext = Path.GetExtension(myFilePath);
// ext would be ".txt"

Solution 2

You may simply read the stream of a file

using (var target = new MemoryStream())
{
    postedFile.InputStream.CopyTo(target);
    var array = target.ToArray();
}

First 5/6 indexes will tell you the file type. In case of FLV its 70, 76, 86, 1, 5.

private static readonly byte[] FLV = { 70, 76, 86, 1, 5};

bool isAllowed = array.Take(5).SequenceEqual(FLV);

if isAllowed equals true then its FLV.

OR

Read the content of a file

var contentArray = target.GetBuffer();
var content = Encoding.ASCII.GetString(contentArray);

First two/three letters will tell you the file type.
In case of FLV its "FLV......"

content.StartsWith("FLV")

Solution 3

At the server you can check the MIME type, lookup flv mime type here or on google.

You should be checking that the mime type is

video/x-flv

If you were using a FileUpload in C# for instance, you could do

FileUpload.PostedFile.ContentType == "video/x-flv"

Solution 4

I'm not sure if this is what you want but:

Directory.GetFiles(@"c:\mydir", "*.flv");

Or:

Path.GetExtension(@"c:\test.flv")

Solution 5

string FileExtn = System.IO.Path.GetExtension(fpdDocument.PostedFile.FileName);

The above method works fine with the Firefox and IE: I am able to view all types of files like zip,txt,xls,xlsx,doc,docx,jpg,png.

But when I try to find the extension of file from Google Chrome, I fail.

View more solutions

Comments

[hansvb]

If possible, you want to also check on the client, to avoid unnecessary uploads.

[ZombieSheep]

Yes, but see my answer below - do NOT rely on client side checking - it will be circumvented sooner or later. :)

[hansvb]

The client-side check is not a protection for your server, but a convenience for the user.

[ZombieSheep]

Granted. I'm just advising the OP not to rely on it.

[hansvb]

While he cannot prevent a hacker from uploading what he wants, he should still check on the client side as a convenience to the user. Flash uploaders should be able to check the file type.

[David Glenn]

This allows someone to just rename any file *.flv and upload it. Depending on what your requirements are, you might want to check the MIME type as well.

[ZombieSheep]

The OP didn't mention Flash uploaders (that is 'uploaders written in Flash', rather than 'uploaders of Flash content'). The question is tagged with asp.net and c# tags, and with those technology choices, the client-side checking is limited and easily defeated. :)

[hansvb]

Does not the MIME type usually get set according to the file name extension?

[hansvb]

For a video upload site, he should have something better on the client-side then an HTML upload form. Multi-MB uploads without a progress bar are no fun.

[Surya sasidhar]

ok you saying that client side check is not that much good how can i check in server side Mr. ZombieSheep

[ZombieSheep]

@Thilo - I couldn't agree more, but the question is about an ASP.net upload form. It's up to the OP whether he thinks that's good enough or not.

[hansvb]

@Surya: plenty of answers about server-side checks already on this page.

[ZombieSheep]

@Surya sasidhar - This should get you started... -> msdn.microsoft.com/en-us/library/aa479405.aspx

[Mark Dickinson]

@Thilo, you're right, but the extension can be changed without changing the mime content type. The mime type describes the data contained in the file, so it can be handled appropriately see en.wikipedia.org/wiki/MIME

[Marat Faskhiev]

No, the better way is to check file content. It is necessary to check flv signature.

[PRMan]

This should be rated higher. If you really want your application to work and the data is untrusted, you should check the beginning.

[James]

Just to add to this since it’s still a popular answer - the MIME type argument is just as insecure as the extension as both can be spoofed. A combination of both checks is probably a reasonable solution but ultimately if security is a concern then there should be more rigourous checks e.g. blocking unsigned files or content sampling.

[hubert17]

This does not all the time behave well in Windows 7.

[James]

@hubert17 interesting, in what way? Also which version of .NET?

[MAXE]

What's the relation between Firefox, IE, Chrome and C#? The OP is talking about server-side code, nothing about the browser or any type of client code...