8

I'm using Spring 3 ability to upload a file. I would like to know the best way to validate that a file is of a certain type, specifically a csv file. I'm rather sure that checking the extension is useless and currently I am checking the content type of the file that is uploaded. I just ensure that it is of type "text/csv". And just to clarify this is a file uploaded by the client meaning I have no control of its origins.

I'm curious how Spring/the browser determines what the content type is? Is this the best/safest way to determine what kind of file has been uploaded? Can I ever be 100% certain?

UPDATE: Again I'm not wondering how to determine what the content type is of a file but how the content type gets determined. How does spring/the browser know that the content type is a "text/csv" based on the file uploaded?

1
  • Had the same problem. Why Spring does not supports the option "Determined from the container" like in usual java files? If I set the enconding in my maven module as UTF-8 I expect that my files will have this encoding by default and I won't need to change in manually
    – borjab
    Aug 31, 2015 at 9:08

5 Answers 5

1

You can use

org.springframework.web.multipart.commons.CommonsMultipartFile object.

it hasgetContentType(); method.

Look at the following example http://www.ioncannon.net/programming/975/spring-3-file-upload-example/

you can just add the simple test on CommonsMultipartFile object and redirect to error page if it the content type is incorrect.

1
  • I think your misunderstanding my question. I know about getContentType() and am using it already. The question is how does that content type get determined? I am having a debate with a colleague and he thinks that the content type is no more useful than the extension as it can be arbitrarily be set to anything. But I'm curious to as how Spring/the browser says this file is a "text/csv"? The purpose of this is to reject a file that is not a true csv file, how can you really ever be sure it is?
    – sauce
    Aug 24, 2011 at 19:30
1

So you can also count the number of commas in the file per line.There should normally be the same amount of commas on each line of the file for it to be a valid CSV file.

1
  • Not a bad idea for small files..but files with 100k lines probably isn't practical to go through them all. I suppose you could check the first 10 lines or something. Not exactly what I was looking for but just another way to validate manually. I just wish I knew I could rely on the content type being set right.
    – sauce
    Aug 25, 2011 at 19:46
0

Why you don't just take the file name in you validator and split it, the file type is fileName.split("\.")[filename.length()-1] string

1
  • File extensions are essentially worthless, its a look in the right direction but not gonna cut it. You could have a file with no extension that is really a CSV file and somehow the browser/Spring knows what type of file it is. I'm wondering how it knows that.
    – sauce
    Aug 24, 2011 at 19:32
0

Ok, in this case i suggest you to use the Csvreader java library. You just have to check your csvreader object and that's all.

0

As far as I'm aware the getContentType(String) method gets its value from whatever the user agent tells it - so you're right to be wary as this can easily be spoofed.

For binary files you could check the magic number or use a library, such as mime-util or jMimeMagic. There's also Files.probeContentType(String) since Java 7 but it only works with files on disk and bugs have been reported on some OSes.

1
  • I think there is a way to get the path to the TMP file and probe that one before copying to the destination. Aug 18, 2021 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.