csharp MVC操作筛选器允许上载安全文件属性

Posted 2021-05-12

using  System;
using  System.linq;
using  System.collections.generic;
using  System.IO;
using  System.web.mvc;
 
namespace  Securitymodule
{
    [Attributeusage (Attributetargets.method, Allowmultiple = false )]
    public  sealed  class  Allowuploadsafefilesattribute: Actionfilterattribute
    {
        static  readonly  IList < string > Exttofilter = new  List < string > {
            ". Aspx" , ". Asax" , ". asp" , ". Ashx" , ". aspx," , ". Axd" , ". master" , ". svc" , ". php"  ,        
            ". Php3"  , ". php4" , ". Ph3" , ". Ph4" , ". php4" , ". Ph5" , ". Sphp" , ". cfm" , ". ps" , ". Stm" ,
            ". Htaccess" , ". Htpasswd" , ". php5" , ". Phtml" , ". cgi" , ". pl" , ". Plx" , ". py" , ". rb" , ". sh" , ". jsp" ,
            ". Cshtml" , ". Vbhtml" , ". swf"  , ". Xap" , ". Asptxt"
        };
 
        static  readonly  IList < string > Nametofilter = new  List < string > {
           "Web.config"  , "htaccess"  , "Htpasswd" , "web ~ 1.con"
        };
 
        static  bool  Canupload ( string  fileName)
        {
            if  ( string . Isnullorwhitespace (fileName))
                return  false ;
 
            fileName = fileName.ToLowerInvariant ();
            var name = Path.GetFileName (fileName);
            var ext = Path.GetExtension (fileName);
 
            if  ( string . Isnullorwhitespace (name))
                throw  new  InvalidOperationException ( "Uploaded file should have a name." );
 
            return  ! Exttofilter.contains (ext) &&
                   ! NameToFilter.Contains (name) &&
                   ! NameToFilter.Contains (ext) &&
                   / / For "file.asp;. Jpg" files
                   ExtToFilter.All (item =>! Name.Contains (item));
        }
 
        public  override  void  Onactionexecuting (Actionexecutingcontext Filtercontext)
        {
            var files = filterContext.HttpContext.Request.Files;
            foreach  ( string  file in  files)
            {
                var postedFile = files [file];
                if  (Postedfile == null  | | Postedfile.contentlength == 0) continue ;
 
                if  (! Canupload (Postedfile.filename))
                    throw  new  InvalidOperationException ( string . Format ( "You are not allowed to upload file {0}." , Path.getfilename (Postedfile.filename)));
            }
 
            base . Onactionexecuting (Filtercontext);
        }
    }
}