File Upload

[[deleted]]

Hi All,

I'm presented with an interesting problem. I'm creating a page where people upload .jar files. When I echo the filetype in IE it says 'application/x-zip-compressed' which is the same as a zip file, but I don't want people uploading .zip files only .jar. If I change the filetype to 'application/java-archive' my check on the filetype fails.

Now it could be simple and say if the extention is .jar AND the file type is 'application/x-zip-compressed' then it's ok, but in that scenario a user could just change the file extention to .jar and upload which would still upload the wrong type of file. Can somebody help me with this or is it just something I'm going to have to live with?

Since I'm working away here, it would be great if you could also email me at [e-mail] so that I get the replies faster.

Thanks,
Stephanie

[fil]

There's no way to enforce the type of file the user uploads, they're always going to have a way to trick you (they can just use a browser that doesn't support any checking).

You'll have to do all the validation on the server side (it's the only secure way anway)

[[deleted]]

Yes, I'm using PHP to check the file type. The code is as follows:

$filetype = $_FILES['filejar']['type'];
if ($filetype != 'application/java-archive')
{
$strfiletypeerror = 1;
}

The problem is that when somebody uploads a valid .jar file it is shown as application/x-zip-compressed and not application/java-archive as expected.

In netscape it validates as application/java-archive. Why would these be different?

My question is if anybody else has seen this problem and how I can assure that the file is a valid .jar.

Thanks,
Steph

[Weedpacket]

What is a valid jar file, as opposed to an ordinary zip file? The only difference I can find is that one has a .jar extension and the other has a .zip extension. unzip will quite happily unzip a renamed .jar file, and jar will quite happily extract a renamed .zip file.

(It's because the two archives have identical formats that either MIME type can be used; one is going by the file extension, the other by deducing the format.)

.jars usually have a Meta-inf directory with a manifest file in it; but if I recall rightly, jar gives the option of leaving that out.

But because the formats are identical, I guess you could use PHP's zip functions to examine the jar's contents (look for a Meta-inf directory, say).