Java进行文件格式校验的方案详解

@Getter
public enum MimeTypeEnum {

    IMAGE_JPEG("image/jpeg", "FFD8", "FFD9"),
    IMAGE_PNG("image/png", "89504E470D0A1A0A", null),
    IMAGE_BMP("image/bmp", "424D", null),
    ;

    private final String mimeType;
    private final byte[] header; // 文件头
    private final byte[] footer; // 文件尾

    MimeTypeEnum(String mimeType, String header, String footer) {
        this.mimeType = mimeType;
        this.header = header == null ? null : DatatypeConverter.parseHexBinary(header);
        this.footer = footer == null ? null : DatatypeConverter.parseHexBinary(footer);
    }

    public static final Set<MimeTypeEnum> whiteList = Sets.newhttp://www.chinasem.cnHashSet(IMAGE_JPEG, IMAGE_PNG);
}

public static void test(MultipartFile mFile) throws Exception {
    MimeTypeEnum mimeType = detectMimeType(mFile);

    Assert.isTrue(MimeTypeEnum.whiteList.contains(mimeType), "不支持文件类型：" + mimeType);
}

public static MimeTypeEnum detectMimeType(MultipartFile multipartFile) throws IOException {
    try (InputStream inputStream = multipartFile.getInputStream()) {
        byte[] header = new byte[8]; // 读取前 8 个字节
        byte[] footer = new byte[2];// 读取后 2 个字节
        inputStream.read(header);
        inputStream.skip(multipartFile.getSize() - 2 - 8);
        inputStream.read(footer);

        for (MimeTypeEnum mimeTypeEnum : MimeTypeEnum.values()) {
            if (matchMagicNumber(header, footer, mimeTypeEnum)) {
          vKxOxNQe      return mimeTypjavascripteEnum;
            }
        }
    }
    return null;
}


private static boolean matchMagicNumber(byte[] header, byte[] footer, MimeTypeEnum mimeType) {
    // 检查文件头
    if (!Arrays.equals(mimeType.getHeader(), Arrays.copyOf(header, mimeType.getHeader().length))) {
        return false;
    }

    // 检查文件尾
    if (mimeType.getFooter() != null) {
        return Arrays.equals(mimeType.getFooter(), footer);
    }
    return true;
}

<mime-type type="image/avif">
    <!-- According to https://github.com/libvips/libvips/pull/1657
      older avif used to use the the heif 'ftypmif1' as well -->
    <_comment>AV1 Image File</_comment>
    <acronym>AVIF</acronym>
    <tika:link>https://en.wikipedia.org/wiki/AV1#AV1_Image_File_Format_(AVIF)</tika:link>
    <magic priority="60">
      <match value="ftypavif" type="string" offset="4"/>
    </magic>
    <glob pattern="*.avif"/>
</mime-type>

public void test(MultipartFile file) {                                                                                                           
    String mimeType = new Tika().detect(file.getInputStream());

    log.info(mimeType) // image/avif
}

/* 文件类型白名单 */
public static List<String> mimeTypeWhiteList = Arrays.asList(
    "image/jpeg", 
    "image/png");

public  void test(MultipartFile multipartFile) throws Exception {
    String mimeType = new Tika().detect(file.getInputStream());
    
    if ("application/x-tika-ooxml".equals(mimeType)) {
        mimeType = detectOOXML(file);
    }
    log.info(mimeType);

    Assert.isTrue(mimeTypeWhiteList.contains(mimeType), "不支持文件类型：" + mimeType);
}

/php**
 * 解析ooxml（Office Open XML File Formats）
 */
private String detectOOXML(File file) throws IOException {
    try (ZipFile zipFile = new ZipFile(file)) {
        if (zipFile.getEntry("word/document.xml") != null) {
            return "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
        }
        if (zipFile.getEntry("xl/workbook.xml") != null) {
            return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
        }
        if (zipFile.getEntry("ppt/presentation.xml") != null) {
            return "application/vnd.openxmlformats-officedocument.presentationml.presentation";
        }
    }
    return "application/zip";
}

private static String detectMsOffice(InputStream inputStream) throws Exception {
    byte[] buffer = new byte[1024 * 10];

    while (inputStream.read(buffer) != -1) { // todo 滑动窗口优化
        if (containsSubArray(buffer, "Excel".getBytes())) {
            return "application/vnd.ms-excel";
        }
        if (containsSubArray(buffer, "PowerPoint".getBytes())) {
            return "application/vnd.ms-powerpoint";
        }
        if (containsSubArray(buffer, "Office Word".getBytes())) {
            return "application/msword";
        }
    }
    return "unknown";
}