Package de.xima.fc.security.malware

Class ExtensionCheck

  • public class ExtensionCheck
extends Object
    Helper class to verify a file's extension against its content.

    • Constructor Detail

      • ExtensionCheck

        public ExtensionCheck()

    • Method Detail

      • setContextMimeMapper

        public ExtensionCheck setContextMimeMapper​(Function<String,​String> contextMimeMapper)
        Sets the mandatory MIME mapper used for comparing the MIME type detected by the ContentTypeUtils to the one suggested by the 'context' for the provided file name, e.g. by ServletContext.getMimeType(String).
        Parameters:
        contextMimeMapper - A Function that takes a file name and returns the MIME type corresponding to the file name's extension
        Returns:
        this

      • setMimeNormalizer

        public ExtensionCheck setMimeNormalizer​(IMimeNormalizer mimeNormalizer)
        Sets an optional, use case dependent MIME type normalizer to handle different MIME types describing the same content (e.g. 'application/xml', 'text/xml' and 'application/xhtml+xml' may be mapped to 'text/plain').
        Parameters:
        mimeNormalizer - the MIME normalizer to use.
        Returns:
        this

      • setAllowUnknownTypes

        public ExtensionCheck setAllowUnknownTypes​(boolean allowUnknownTypes)
        Sets whether unknown types (undetected by the ContentTypeUtils or unknown to the context mime mapper) should be allowed or rejected.
        Parameters:
        allowUnknownTypes - the flag to set (if true, unknown types are allowed, if false not)
        Returns:
        this

      • verify

        public ExtensionCheckReport verify​(String fileName,
                                   InputStream inputStream)
        Compares the MIME type detected by Tika (by examining the streams content) with the one suggested by the provided context MIME mapper.
        • If no MIME normalizer has been set, DFLT_NORMALIZER will be used.
        • If the MIME normalizer has been explicitly set to null, no normalization will be done.
        Parameters:
        fileName - the name of the file (used to request the MIME type corresponding to the file's extension from the context MIME mapper)
        inputStream - the input stream to detect the file's actual content type
        Returns:
        a report object describing the result of this content type verification.