Common File Extensions Reference

Practical Snippet

Key points: (1) extensions can be changed at will, so validation must read header magic (PNG 89 50 4E 47, PDF 25 50 44 46, ZIP 50 4B 03 04) and require extension, magic and declared type to agree; (2) SVG is the most overlooked executable format and can carry script plus on* handlers, with SVGZ a compressed variant that gives no hint — transcode or strip it; (3) the filename is itself an attack surface, so defend against double extensions, path traversal and zero-width characters together, and whitelist extensions rather than blacklisting them; (4) store under a random ID and keep the original name for display only, which removes directory traversal by construction.

// ① 魔数识别（比扩展名可靠）
const MAGIC = [
  { ext: 'png',  bytes: [0x89, 0x50, 0x4e, 0x47] },
  { ext: 'jpg',  bytes: [0xff, 0xd8, 0xff] },
  { ext: 'pdf',  bytes: [0x25, 0x50, 0x44, 0x46] },
  { ext: 'zip',  bytes: [0x50, 0x4b, 0x03, 0x04] },  // 也是 docx/xlsx 容器
  { ext: 'gif',  bytes: [0x47, 0x49, 0x46, 0x38] },
  { ext: 'elf',  bytes: [0x7f, 0x45, 0x4c, 0x46] },
]

function sniffMime(file) {
  const b = new Uint8Array(file.slice(0, 16))
  for (const m of MAGIC) {
    if (m.bytes.every((v, i) => b[i] === v)) return m.ext
  }
  return 'unknown'
}

// ② 交叉验证：扩展名 + 魔数 + 声明类型必须一致
const ALLOW = new Set(['png', 'jpg', 'pdf'])
async function safeCheck(file) {
  const ext = file.name.split('.').pop().toLowerCase()
  const magic = sniffMime(file)
  if (!ALLOW.has(magic)) throw new Error('魔数不在白名单: ' + magic)
  if (ext !== magic) throw new Error('扩展名与内容不符: ' + ext + ' vs ' + magic)
  return true   // ✅ 三者一致才放行
}

// ③ 🔴 文件名净化：防双扩展名 / 路径穿越 / 零宽字符
function safeName(raw) {
  let n = raw.split(/[\/]/).pop()          // 取 basename，丢弃路径
  n = n.replace(/[​-‍]/g, '')  // 零宽字符
  n = n.replace(/../g, '')                   // 路径穿越残留
  const parts = n.split('.')
  const ext = parts.pop().toLowerCase()
  const base = parts.join('.')               // ← 保留全部中间段，双扩展名才拦得住
  if (!/^[a-zA-Z0-9_-]+$/.test(base)) throw new Error('非法文件名')
  if (!ALLOW.has(ext)) throw new Error('扩展名不允许')
  return base + '.' + ext
}
console.log(safeName('shell.php.jpg'))       // 抛错（双扩展名）
console.log(safeName('../../etc/passwd'))   // passwd（无扩展名→抛错）

// ④ 存储用随机 ID，不用原始文件名（防目录遍历与信息泄露）
import { randomUUID } from 'crypto'
const stored = randomUUID() + '.' + ext
console.log('原名仅作展示，存储名:', stored)

// ⑤ SVG 要特别处理
const DANGEROUS_SVG = /<(script|foreignObject)|sonw+=/i
if (file.name.endsWith('.svg') && DANGEROUS_SVG.test(await file.text())) {
  throw new Error('SVG 含脚本或事件处理器，拒绝')
}