Spring MVC - Change in .Exe file to .txt makes browser change content type - security

In my Spring MVC 3.0 based application I am trying to test the file upload functionality with some validations.
In one validation I changed .exe(executable) file to .txt , and expecting that exe file shouldn't be uploaded in the system.But it gets uploaded.
I am checking content type of file but in this case once file extension is changed it's content types also gets changed from "application/octet-stream" to "text/plain".
I am testing on Firefox and Google Chrome. And At Controller level Uploaded file is being read using MultipartFile.
Is there any way by which I get the original content type of file in this case "application/octet-stream" ?

When we change the extension of the file before uploading it ..It depends on Operating System weather the MIME type will change or not. Moreover, it is the responsibility of the browser to find out the Mime Type and set into the request header which is being read in the controller.

Related

how do I sniff file mime type nodejs

i am creating a api service using nodejs and express and to parse multipart request i am using multerjs. I have to receive a pdf file from rest request and it is coming as multipart/form-data and to verify file type i am checking the file.minetype
Now the issue is if someone changes the file extension like from mp4 -> pdf it also changes the mimetype to pdf and the file is accepted as pdf so how do i sniff the mimetype for content is their any way to do without any new packages. I really need to do it without using any packages as it'll take a really long to get a new package to approved

Can't create .zip file with Azure Logic Apps' SharePoint Create File action

I'm trying to create a .zip file by passing the returned body of an HTTP GET request to SharePoint's Create File.
Body is:
{
"$content-type": "application/zip",
"$content": "UEsDBBQACA...="
}
Shouldn't this just work? The docs only define the Create File field as "Content of the file." but that's not super informative...
I believe I've done this before with a file that was application/pdf and it worked. Unfortunately, I can't find that Logic App (I think it may have been an experiment I've since deleted).
I should note that the Create File action does create a valid .zip file, in that it's not corrupt, but archive is empty. It's supposed to contain a single .csv file.
I tried decoding the Base64 content and it's definitely binary data.
Any idea where I'm going wrong?
I test with Postman and when I use the form-data way to POST the request, I found the .zip file couldn't be open. Then I check the Logic App run history and I find the problem is if just use the triggerbody() as the file content it will fail.
This is because the triggerbody() not just have the $content, so I change the expression to triggerBody()['$multipart'][0]['body'] then it works and the .zip file is full.

How to know mime type when using Github API

I use JS lib (https://github.com/mikedeboer/node-github) to call GitHub api: https://developer.github.com/v3/repos/contents/ to get content from repo.
When the return type is 'file', I want to know it's mime-type. If I write the return content into a file on hard driver, there are lots of way to tell the mime-type.
My question is how to know the mime-type without writing it into a file on hard driver.
That information is not available through the Git API (which for performance reason, does not scan all files to determine their MIME)
That means, since you don't want to write the file and analyse it with, for instance, npm mime-type, that you will have to rely on the file name extension (with npm broofa/node-mime, or now npm mime for instance).
That is not as reliable as analyzing the stream content, but it is a possible workaround.
var mime = require('mime');
mime.lookup('/path/to/file.txt'); // => 'text/plain'
mime.lookup('file.txt'); // => 'text/plain'

Nodejs if file exists from different url

Is it possible to check if image exists using absolute path? I have 2 apps using one domain, but with different ports. I want to check if the file exists on other app. For example from www.domain.com:80 I want to check if this file exists: www.domain.com:8080/images/image1.jpg. I have tried to do it with fs.exists, fs.existsSync, fs.Stats, but it on the first 2 functions it always returns false and on the fs.Stats it returns error "ENOENT, no such file or directory", but I can view the file entering url on browser. How can I do it?
The fs functions look for files on your local filesystem. If you want to see if a remote file exists, you'll have to make an HTTP request using the http module, request module or the like.

Serving .config files

We have a legacy (classic asp) CRM that I maintain in my organization. Users may upload files through the web front, they are stored on a network share and the filename, uploader, etc is saved to a database. Everything is well and good with the exception of .config files.
For some reason certain people can download these just fine, but other people recieve this error:
The type of page you have requested is not served because it has been explicitly forbidden. The extension '.config' may be incorrect.
it would seem that on some users computers the link for the file is "file://networkshare/filename" (which works) and on other machines it is "http://networkshare/filename". (which doesn't work)
I have the mime type for .config set to text/plain in iss6. All users are running IE8.
The code on the page creates a href links based on records returned from the database.
Why then is there there the difference in the way the link is rendered differently in the same browser on different pc's? How do I allow .config files allowing people to view the sites web.config?
The code that builds the link is:
function getlink(file_nm,path)
{
thisPage.navigate.CheckDocumentAttachedToRequest(file_nm, path)
var sDocLink = path.replace(/\//g,"\\") + "\\" + file_nm;
return "<A class=\"parislink2\" TARGET=\"_BLANK\" HREF=\"\\\\" + thisPage.get_sServerName() + "\\" + sDocLink + "\">" + file_nm + "</A>";
}
Weird.
I know that IIS 6 will return error 404.3 if a client request refers to a file name extension that is not defined in the MIME types.
However you do have it defined. You can try as a test using the wildcard () in your mime types. ( for the file extension and text/plain for the mime type.) The wildcard can be a security risk but if you are serving up configs..perhaps this application and server are internal to your network and it would be ok to use the wildcard.
I would also check your ISAPI extensions (not filters, but extensions) and make sure .config
is still in there. It should be by default.
Defining a mime type at the global level in IIS should filter down through and override any mime types set at the folder level.
An IIS reset is needed everytime you change mime types.
Perhaps it is a browser issue?
(an issue on the client side for the links that do not work..an issue like "browser control".)
It is almost as if some of the browsers are interpreting your function correctly when the link is built..and others are substituting "http" instead of "file" as the protocol when they render the HTML from the function call. Perhaps you could hardcode your function to us "file:" as a string that is placed at the begining of your link code. (trying to overide any "http" string that gets place in there by the HTML sent back by the server or rendered by IE8.)
The wildcard was filtered out for security purposes in the above post. (wildcard = "an asterisk")

Resources