提取文件头签名，因为它在 ASP.NET Core 中直接流式传输到磁盘

Question

我有一个 API 方法，可以将上传的文件直接流式传输到磁盘以使用病毒检查程序进行扫描。其中一些文件可能非常大，因此 IFormFile 是不行的：

任何超过 64 KB 的单个缓冲文件都会从内存移动到 磁盘上的临时文件。 来源：https://docs.microsoft.com/en-us/aspnet/core/mvc/models/file-uploads?view=aspnetcore-3.1

我有一个使用 multipart/form-data 和 a really nice NuGet package that takes out the headache when working with multipart/form-data 的工作示例，它运行良好，但是我想添加一个 file header signature check，以确保文件客户定义的类型实际上就是他们所说的。我不能依靠文件扩展名来安全地执行此操作，但我可以使用文件头签名使其至少更安全一点。由于我是直接流式传输到磁盘，如何在文件流中提取第一个字节？

[DisableFormValueModelBinding] // required for form binding
[ValidateMimeMultipartContent] // simple check to make sure this is a multipart form
[FileUploadOperation(typeof(SwaggerFileItem))] // used to define the Swagger schema
[RequestSizeLimit(31457280)] // 30MB
[RequestFormLimits(MultipartBodyLengthLimit = 31457280)]
public async Task<IActionResult> PostAsync([FromRoute] int customerId)
{
    // place holders
    var uploadLocation = string.Empty;
    var trustedFileNameForDisplay = string.Empty;

    // this is using a nuget package that does the hard work on reading the multipart form-data.... using UploadStream;
    var model = await this.StreamFiles<FileItem>(async x =>
    {
        // never trust the client
        trustedFileNameForDisplay = WebUtility.HtmlEncode(Path.GetFileName(x.FileName));

        // determien the quarantine location
        uploadLocation = GetUploadLocation(trustedFileNameForDisplay);

        // stream the input stream to the file stream
        // importantly this should never load the file into memory
        // it should be a straight pass through to disk
        await using var fs = System.IO.File.Create(uploadLocation, BufSize);
        
        // --> How do I extract the file signature? I.e. a copy of the header bytes as it is being streamed??? <--
        await x.OpenReadStream().CopyToAsync(fs);
    });

    // The model state can now be checked
    if (!ModelState.IsValid)
    {
        // delete the file
        DeleteFileIfExists(uploadLocation);

        // return a bad request
        ThrowProblemDetails(ModelState, StatusCodes.Status400BadRequest);
    }

    // map as much as we can
    var request = _mapper.Map<CreateAttachmentRequest>(model);

    // map the remaining properties
    request.CustomerId = customerId;
    request.UploadServer = Environment.MachineName;
    request.uploadLocation = uploadLocation;
    request.FileName = trustedFileNameForDisplay;

    // call mediator with this request to send it over WCF to Pulse Core.
    var result = await _mediator.Send(request);

    // build response
    var response = new FileResponse { Id = result.FileId, CustomerId = customerId, ExternalId = request.ExternalId };

    // return the 201 with the appropriate response
    return CreatedAtAction(nameof(GetFile), new { fileId = response.Id, customerId = response.customerId }, response);
}

我坚持的部分在await x.OpenReadStream().CopyToAsync(fs); 附近。我想在这里拉出文件头，因为流被复制到FileStream。有没有办法添加某种检查员？我不想要to read the entire stream again，只想要标题。

更新

根据@Ackdari 给出的答案，我已成功切换代码以从上传的文件流中提取标题。我不知道这是否可以提高效率，但它确实有效：

//...... removed for clarity
var model = await this.StreamFiles<FileItem>(async x =>
{
    trustedFileNameForDisplay = WebUtility.HtmlEncode(Path.GetFileName(x.FileName));
    quarantineLocation = QuarantineLocation(trustedFileNameForDisplay);

    await using (var fs = System.IO.File.Create(quarantineLocation, BufSize))
    {
        await x.OpenReadStream().CopyToAsync(fs);

        fileFormat = await FileHelpers.GetFileFormatFromFileHeader(fs);
    }
});
//...... removed for clarity

和

// using https://github.com/AJMitev/FileTypeChecker
public static async Task<IFileType> GetFileFormatFromFileHeader(FileStream fs)
{
    IFileType fileFormat = null;
    fs.Position = 0;
    var headerData = new byte[40];
    var bytesRead = await fs.ReadAsync(headerData, 0, 40);
    if (bytesRead > 0)
    {
        await using (var ms = new MemoryStream(headerData))
        {
            if (!FileTypeValidator.IsTypeRecognizable(ms))
            {
                return null;
            }

            fileFormat = FileTypeValidator.GetFileType(ms);
        }
    }

    return fileFormat;
}

Answer 1

您可能需要考虑自己阅读标题，具体取决于预期的文件类型

int n = 4; // length of header

var headerData = new byte[n];
var bytesRead = 0;
while (bytesRead < n)
    bytesRead += await x.ReadAsync(headerData.AsMemory(bytesRead));

CheckHeader(headerData);

await fs.WriteAsync(headerData.AsMemory());

await x.CopyToAsync(fs);