WO2020211555A1 - File detection method, apparatus and device, and computer-readable storage medium - Google Patents

Abstract

A file detection method, apparatus and device, and a computer-readable storage medium. Said method comprises the steps of: upon acquisition of a file to be uploaded, acquiring a first file suffix of said file (S10); if the first file suffix is a valid file suffix, detecting whether there is a file magic number in said file (S20); if there is a file magic number in said file, acquiring a second file suffix corresponding to the file magic number (S30); if the first file suffix is different from the second file suffix, determining that said file fails to pass the file uploading vulnerability detection (S40). Said method defends against file uploading vulnerability by means of a double verification of the file suffix and the file magic number, improving the success rate of file uploading vulnerability detection, and improving the security of files in a server.

Description

File detection method, device, equipment and computer readable storage medium

[0001] This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on April 18, 2019, the application number is 201910315457. 4. The title of the invention is "file detection method, device, equipment and computer readable storage medium". , Its entire contents are incorporated in the application by reference.

Technical field

[0002] This application relates to the technical field of information security in financial technology, and in particular to a file detection method, device, device, and computer-readable storage medium.

Background technique

[0003] With the continuous development of financial technology (Fintech), especially Internet technology finance, financial institutions (such as banks) will upload more and more files to the server for storage, and the financial institution uploads files to the server. The security has high requirements. Therefore, in the process of uploading files to the server by financial institutions, file upload loopholes should be avoided to protect the security of the files stored in the server. File upload vulnerability refers to the fact that the programmer has insufficient control over the user's file upload part or processing flaws, which results in the user being able to override his own authority to upload executable dynamic script files to the server. The files uploaded here can be Trojan horses, viruses, malicious scripts or WebShells, etc. This attack method is the most direct and effective. There is no problem with "file upload" itself. The problem is how the server processes and interprets the file after the file is uploaded. If the processing logic of the server is not secure enough, it will lead to serious consequences.

[0004] The file upload vulnerability itself is a very harmful vulnerability, and WebShell expands the use of this vulnerability infinitely. After most upload vulnerabilities are exploited, the attacker will leave WebShell to facilitate subsequent access to the system. After the attacker places or inserts a WebShell on the affected system, he can use the WebShell to do whatever he wants in the service more easily and more covertly. Therefore, how to improve the success rate of file upload vulnerability detection is an urgent problem to be solved.

Summary of the invention

technical problem

The solution to the problem Technical solutions

[0005] The main purpose of this application is to provide a file detection method, device, device, and computer-readable storage medium, which aims to solve the technical problem of how to improve the success rate of file upload vulnerability detection.

[0006] In order to achieve the above object, the present application provides a file detection method, the file detection method includes the steps

[0007] After obtaining the file to be uploaded, obtain the first file suffix of the file to be uploaded;

[0008] If the first file suffix is a legal file suffix, detecting whether the file to be uploaded has a file magic number;

[0009] If the file to be uploaded has a file magic number, the second file suffix corresponding to the file magic number is acquired; [0010] if the first file suffix is different from the second file suffix, then it is determined The file to be uploaded fails the file upload vulnerability detection.

[0011] In addition, in order to achieve the above objective, the present application also provides a file detection device, the file detection device includes:

[0012] The obtaining module is configured to obtain the first file suffix of the file to be uploaded after obtaining the file to be uploaded

[0013] The detection module is configured to detect whether the file to be uploaded has a file magic number if the first file suffix is a legal file suffix;

[0014] The obtaining module is further configured to obtain a second file suffix corresponding to the file magic number if the file to be uploaded has a file magic number;

[0015] The determining module is configured to determine that the file to be uploaded fails the file upload vulnerability detection if the suffix of the first file is different from the suffix of the second file.

[0016] In addition, in order to achieve the above object, the present application also provides a file detection device, the file detection device includes a memory, a processor, and a file detection program stored in the memory and running on the processor When the file detection program is executed by the processor, the steps of the file detection method described above are implemented.

[0017] In addition, in order to achieve the above object, the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a file detection program, and when the file detection program is executed by a processor, the above The steps of the file detection method. [0018] This application defends file upload vulnerabilities by double checking the file suffix and the file magic number. It is determined that the first file suffix of the file to be uploaded is a legal file suffix, and the file to be uploaded has a file magic number, and the file magic number corresponds to If the second file suffix is different from the first file suffix, it is determined that the file to be uploaded fails the file upload vulnerability detection, which improves the success rate of file upload vulnerability detection and improves the security of the file in the server.

The beneficial effects of the invention

Brief description of the drawings

Description of the drawings

[0019] FIG. 1 is a schematic flowchart of a preferred embodiment of the document detection method of the present application;

[0020] FIG. 2 is a schematic diagram of a process for obtaining the first file suffix of the file to be uploaded after obtaining the file to be uploaded in an embodiment of the present application;

[0021] FIG. 3 is a schematic diagram of another process for obtaining the first file suffix of the file to be uploaded after obtaining the file to be uploaded in an embodiment of the present application;

[0022] FIG. 4 is a functional schematic block diagram of a preferred embodiment of the document detection device of the present application;

[0023] FIG. 5 is a schematic structural diagram of a hardware operating environment involved in a solution of an embodiment of the present application.

[0024] The realization, functional characteristics, and advantages of the objectives of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Invention embodiment

Embodiments of the invention

[0025] It should be understood that the specific embodiments described here are only used to explain the application, and are not used to limit the application.

[0026] The present application provides a file detection method. Referring to FIG. 1, FIG. 1 is a schematic flowchart of a preferred embodiment of the file detection method of this application.

[0027] The embodiments of the present application provide embodiments of the file detection method. It should be noted that although the logical sequence is shown in the flowchart, in some cases, the sequence shown here may be executed in a different order. Steps out or described.

[0028] The file detection method is applied to a file detection device, a server or a terminal. The terminal may include, for example, a mobile phone, a tablet computer, a notebook computer, a handheld computer, and a personal digital assistant (Personal Digital Assistant). Assistant, PDA) and other mobile terminals, as well as fixed terminals such as digital TVs and desktop computers. In each embodiment of the file detection method, for ease of description, each embodiment is described with a server as an execution subject. File detection methods include:

[0029] Step S10: After obtaining the file to be uploaded, obtain the first file suffix of the file to be uploaded.

[0030] The financial institution will upload its files to the server in real time or regularly. In the embodiment of the present application, the file that the financial institution needs to upload to the server is recorded as a file to be uploaded. After the server obtains the file to be uploaded uploaded by the financial institution, the server obtains the file suffix of the file to be uploaded, and records the file suffix of the file to be uploaded as the first file suffix. Among them, the file to be uploaded can be sent by the client that has established a communication connection with the server. File suffix is also called file extension. It is a mechanism used by the operating system to mark the file type. Generally speaking, an extension follows the main file name and is separated by a separator. .txt"" in the file name, "Read me" is the main file name, and txt is the extension (text, foreign language full name: Text), which means that this file is considered a plain text file, and the extension can be considered a type It is understandable that the server can obtain the first file suffix of the file to be uploaded by recognizing the file name.

[0031] It should be noted that, in the embodiment of the present application, in order to ensure the security of the file to be uploaded, the following one or more operations may be performed. ①Do not store the files to be uploaded on a web (World Wide Web, Global Wide Area Network or World Wide Web) server. The files in the web server are easily accessed by malicious users with illegal URLs (Uni form Resource Locator); ②To be uploaded The directory of the file should not provide execution restrictions; ③Pass the CSRF (Cross-site request forgery) to prevent uploading of the file to be uploaded; ④Restrict the same file name algorithm hash value (hash) to cover the situation with the surface Malicious users upload illegal files with the same hash value as legal files; ⑤Operation logs of the user’s login and password modification operations should be generated for the files to be uploaded; ⑥If the files to be uploaded are compressed files, check the compressed files one by one The type of each file to be uploaded to avoid illegal files in the compressed file.

[0032] Further, the file detection method further includes:

[0033] Step a: Determine whether the first file suffix exists in the preset file suffix name array.

[0034] Step b: If the first file suffix exists in the file suffix name array, it is determined that the first file suffix is a legal file suffix. [0035] Further, after the server obtains the first file suffix, the server obtains a preset file suffix name array, and determines whether the first file suffix exists in the preset file suffix name array. Among them, the file suffixes acceptable to the server are stored in the file suffix name array, that is, the file suffixes in the file suffix name array are legal file suffixes. It should be noted that after the server obtains the file to be uploaded, the server will initialize the program to obtain the file extension array. If it is determined that the first file suffix exists in the file suffix name array, the server determines that the first file suffix is a legal file suffix. For example, the file extension array contains MPEG (Motion Picture Experts

Group, Motion Picture Experts Group), AVI (Audio Video Interleaved, Audio Video Interleaved)

, ASF (Advanced Streaming

forma, advanced stream format), BMP (BitMaP, bitmap), TIF (Tag Image File Format), GIF (Graphics Interchange Format) and JPEG (Joint Photographic Expert Group, Joint Photographic Expert Group) ) And other file suffixes. If the server determines that the first file suffix is GIF, the server determines that the first file suffix is a legal file suffix.

[0036] Further, the file detection method further includes:

[0037] Step c, if the first file suffix does not exist in the file suffix name array, determine that the first file suffix is an illegal file suffix, and after determining that the first file suffix is an illegal file suffix It is determined that the file to be uploaded fails the file upload vulnerability detection.

[0038] If it is determined that the first file suffix does not exist in the file suffix name array, the server determines that the first file suffix is an illegal file suffix. After the server determines that the first file suffix is an illegal file suffix, the server determines that the file to be uploaded fails the file upload vulnerability detection.

[0039] Step S20: If the first file suffix is a legal file suffix, it is detected whether the file to be uploaded has a file magic number.

[0040] If the server determines that the first file suffix is a legal file suffix, the server detects whether the file to be uploaded has a file magic number. File Magic Number (File Magic Number) is to distinguish file type metadata, and a "magic number" is stored in the file itself. It should be noted that not all file types have file magic numbers. Some file types may not have magic numbers. For example, files in the format of txt do not have file magic numbers, so the server needs to check whether the file to be uploaded exists. File magic Number.

[0041] Further, step S20 includes:

[0042] Step d, if the first file suffix is a legal file suffix, read the file header of the file to be uploaded.

[0043] Further, the process for the server to detect whether the file to be uploaded has a file magic number is: if it is determined that the suffix of the first file is a legal file suffix, reading the file header of the file to be uploaded. Specifically, the server may obtain the file header information of the file to be uploaded through the file path to obtain the file header of the file to be uploaded. The file header is a section of data that undertakes certain tasks at the beginning of the file, and is generally at the beginning. When the file header of the file to be uploaded is read, the file header is compared with the preset file magic number rule to obtain the comparison result. Specifically, when the server reads the file header of the file to be uploaded, it can read characters of a specific length in the file header, such as reading the 8 characters before the file header, or reading the 20 characters before the file header, etc.

[0044] It should be noted that the file magic number rule is preset. There are different file magic numbers for different types of files. One file magic number can correspond to multiple file formats, and different file magic numbers can correspond to the same file format. For example, videos and pictures correspond to different file magic numbers, but one file magic number Can correspond to a variety of image file formats. For example, use key to represent the file magic number, and Value to represent the corresponding file format. Since the file magic number of different file formats may be the same, the key may be duplicated. For example, the file format corresponding to the file magic number A can be PNG (Portable Network Graphics) and JPEG. It can be understood that the file magic number array corresponding to the file magic number is an array storing repeated keys, and the file magic number array is an array corresponding to the rule of storing file magic numbers.

[0045] Specifically, the server may first determine the target character of the file magic number corresponding to various file formats, and then set the file magic number rule according to the position of the target character in the file header. If in a picture file, the first 8 characters in the file header can be used to determine whether the file is a picture, then these 8 characters are the target characters corresponding to the file magic number. When setting the file magic number rule corresponding to the picture file, change The first 8 bits are set as the target characters of the file magic number corresponding to the picture file, and some characters can be added appropriately afterwards. These characters can be any characters, that is, the length of the file magic number rule corresponding to the picture file is at least 8 characters. If in a video file, the 5th to 10th bits in the file header are the target characters of the file magic number corresponding to the video file, it can be determined that the file magic number offset of the video file is 4, that is, the file magic number offset in the file header is 4. Bit 1 to Bit 4 are the offset of the file magic number. At this time, The length of the file magic number rule corresponding to the picture file is also at least 10 characters. Therefore, when reading the file header of the file to be uploaded, the read character length is determined by the length of the file magic number rule, that is, the character length of the read file header must be greater than or equal to the length of the file magic number rule, and the file magic number The length of the rule is greater than or equal to the sum of the offset and the target character. It is understandable that not all files have offsets.

[0046] Further, if the file header read by the server is binary, the server may convert the read file header into hexadecimal. However, in order to obtain the efficiency of the comparison result, it is necessary to ensure that the data format of the file magic number rule is the same as the data format of the read file header, that is, if the corresponding character of the file magic number rule is hexadecimal, the server also needs to change all The read file header is converted from binary to hexadecimal.

[0047] Step e: Detect whether the file header meets a preset file magic number rule.

[0048] Step f: If it is detected that the file header complies with the file magic number rule, it is determined that the file to be uploaded has a file magic number.

[0049] Step g, if it is detected that the file header does not meet the file magic number rule, it is determined that the file to be uploaded does not have a file magic number.

[0050] After the server reads the file header of the file to be uploaded, the server detects whether the file header meets the preset file magic number rule. If it detects that the file header meets the file magic number rule, the server determines that the file to be uploaded has a file magic number; if it detects that the file header does not meet the file magic number rule, the server determines that there is no file magic number to be uploaded. For example, when the file magic number rule of the picture file is FFD8FFDB/

FFD8FFE0/FFD8FFE 1 +00, it means that the server must read at least 10 characters, FFD8FFDB, FFD 8FFE0 and FFD8FFE1 are the target characters corresponding to the picture file, "00" means the two characters after the target character can be any character The first 8 characters are one of FFD8FFDB, FFD8FFE0 and FFD8FFE1, it is determined that the file to be uploaded has a file magic number.

[0051] Step S30: If the file to be uploaded has a file magic number, acquire a second file suffix corresponding to the file magic number.

[0052] If it is determined that the file to be uploaded has a file magic number, the server obtains the file suffix corresponding to the file magic number, and records the file suffix corresponding to the file magic number as the second file suffix. It is understandable that the file magic number can be used to mark the format of the file or protocol. Therefore, the corresponding file suffix can be determined through the file magic number, that is, there is a correspondence between the file magic number and the file suffix. When the server gets the file magic number pair When applying the second file suffix, the server determines whether the first file suffix is the same as the second file suffix.

[0053] Further, the file detection method further includes:

[0054] Step h, if it is detected that the file to be uploaded does not have the file magic number, it is determined that the file to be uploaded has not passed the file upload vulnerability detection.

[0055] Further, if it is detected that the file to be uploaded does not have a file magic number, the server determines that the file to be uploaded has not passed the file upload vulnerability detection. When it is determined that the file to be uploaded fails the file upload vulnerability detection, the server prohibits the upload of the file to be uploaded.

[0056] Further, if it is detected that the file to be uploaded does not have a file magic number, the server may determine that the file to be uploaded passes the file upload vulnerability detection. It should be noted that when it is detected that the file to be uploaded does not have a file magic number, it is determined whether the file to be uploaded passes the file upload vulnerability detection or fails the file upload vulnerability detection, which can be set according to specific business needs.

[0057] Step S40, if the suffix of the first file is different from the suffix of the second file, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[0058] If it is determined that the first file suffix is different from the second file suffix, the server determines that the file to be uploaded fails the file upload vulnerability detection, and prohibits uploading the file to be uploaded after determining that the file to be uploaded fails the file upload vulnerability detection, that is, It is forbidden to store the file to be uploaded in the set storage area, and return a notification message of upload failure to the financial institution, so as to remind the financial institution according to the notification message of the upload failure that the file to be uploaded fails to upload.

[0059] Further, the file detection method further includes:

[0060] Step i: If the suffix of the first file is the same as the suffix of the second file, it is determined that the file to be uploaded passes the file upload vulnerability detection.

[0061] Further, if it is determined that the suffix of the first file is the same as the suffix of the second file, the server determines that the file to be uploaded passes the file upload vulnerability detection. When the server determines that the file to be uploaded passes the file upload vulnerability detection, the server allows the file to be uploaded to be uploaded, that is, the file to be uploaded is stored in the set storage area. After the server stores the file to be uploaded in the set storage area, the server generates a notification message of successful upload to the financial institution to remind the financial institution of the successful upload of the file to be uploaded according to the notification message of successful upload.

[0062] This embodiment uses the double check of the file suffix and the file magic number to prevent file upload vulnerabilities. The first file suffix of the uploaded file is a legal file suffix, and the file to be uploaded has a file magic number, and the second file suffix corresponding to the file magic number is different from the first file suffix, it is determined that the file to be uploaded fails the file upload vulnerability detection. The success rate of file upload vulnerability detection is improved, and the security of files in the server is improved.

[0063] Further, a second embodiment of the document detection method of the present application is proposed.

[0064] The difference between the second embodiment of the file detection method and the first embodiment of the file detection method is that, referring to FIG. 2, step S10 includes:

[0065] Step S11: After obtaining the file to be uploaded, obtain the file path and file name of the file to be uploaded

[0066] After the server obtains the file to be uploaded, the server obtains the file path and file name of the file to be uploaded.

It should be noted that after the server obtains the file to be uploaded, the server generates a storage directory for the file to be uploaded, and the storage directory corresponds to an address, which can be read by the API (Application Programming Interface) function In this address, there is a file path corresponding to the file to be uploaded. Among them, the file path is expressed in the form of a string.

[0067] Step S12, if the file path is a legal file path, and the file name is a legal file name, obtain the first file suffix of the file to be uploaded.

[0068] After the server obtains the file path and file name of the file to be uploaded, the server detects whether the file path is a legal file path and whether the file name is a legal file name. In the server, illegal path characters that cannot be included in the file path are preset, such as

The characters "%", "&", "$", "I", "\", "?", "#" and "" are set as illegal path characters. If the server detects that the file path contains illegal path characters, the server determines that the file path is an illegal file path; if the server detects that the file path does not contain illegal path characters, the server determines that the file path is a legal file path.

[0069] In the service, illegal name characters that cannot be contained in the file name are preset. Illegal name characters can be set according to specific needs. Illegal name characters can be set to be consistent with illegal path characters, or illegal name characters can be set to be inconsistent with illegal path characters. If the server detects that the file name contains illegal name characters, the server determines that the file name is illegal file name; if the server detects that the file name does not contain illegal name characters, the server determines that the file name is a legal file name. [0070] Further, in order to further improve the success rate of file upload vulnerability detection, when the server detects that the file name does not contain illegal name characters, the server can obtain the length of the file name plus the file suffix, and judge the file name plus the file Whether the length of the suffix is less than or equal to the preset length. If it is determined that the length of the file name plus the file suffix is less than or equal to the preset length, the server determines that the file name is a legal file name; if it is determined that the length of the file name plus the file suffix is greater than the preset length, the server determines that the file name is an illegal file name . Among them, the preset length can be set according to specific needs, for example, the preset length can be set to 255 bytes, or set to 356 bytes.

[0071] If it is determined that the file path is a legal file path, and the file name is determined to be a legal file name, the server obtains the first file suffix of the file to be uploaded. Further, if it is determined that the file path is an illegal file path, and/or the file name is an illegal file name, the server determines that the file to be uploaded fails the file upload vulnerability detection.

[0072] It should be noted that in this embodiment of the application, the server may obtain the first file suffix of the file to be uploaded when only determining that the file path is a legal file path; when only determining that the file path is an illegal file path, determine The file to be uploaded fails the file upload vulnerability detection. Or when it is only determined that the file name is a legal file name, the first file suffix of the file to be uploaded is obtained; when only the file name is determined to be an illegal file name, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[0073] In this embodiment, after the file to be uploaded is obtained, the file path and file name of the file to be uploaded are obtained. When it is determined that the file path is a legal file path and the file name is determined to be a legal file name, the file path and file name of the file to be uploaded are obtained. The first file suffix avoids obtaining the first file suffix of the file to be uploaded when the file path is an illegal file path and/or the file name is an illegal file name, and performing subsequent file magic number detection and the first file suffix sum The comparison of the second file suffix improves the efficiency of file upload vulnerability detection, and when the file path is an illegal file path, and/or the file name is an illegal file name, it is determined that the file to be uploaded fails the file upload vulnerability detection, which improves the file upload The success rate of vulnerability detection.

[0074] Further, a third embodiment of the document detection method of the present application is proposed.

[0075] The third embodiment of the file detection method is different from the first or second embodiment of the file detection method in that, referring to FIG. 3, step S10 further includes:

[0076] Step S13: After the file to be uploaded is obtained, it is detected whether the length of the file name of the file to be uploaded is less than or equal to the preset length.

[0077] Step S14: If the length of the file name is less than or equal to the preset length, obtain the file to be uploaded The first file suffix.

[0078] After the server obtains the file to be uploaded, the server obtains the file name length of the file to be uploaded, and compares the file name length of the file to be uploaded with the preset length to detect whether the file name length of the file to be uploaded is less than or equal to Preset length. If it is detected that the file name length of the file to be uploaded is less than or equal to the preset length, the server obtains the first file suffix of the file to be uploaded; if it is detected that the file name length of the file to be uploaded is greater than the preset length, the server determines the file to be uploaded Failed file upload vulnerability detection. Among them, the preset length can be set according to specific needs, for example, the preset length can be set to 256 characters.

[0079] In this embodiment, after the file to be uploaded is obtained, if it is detected that the file name length of the file to be uploaded is less than or equal to the preset length, the first file suffix of the file to be uploaded is obtained, thereby avoiding the problem of the file to be uploaded. When the length of the file name is greater than the preset length, the first file suffix and file magic number of the file to be uploaded are also obtained, and then the first file suffix is compared with the second file suffix magic number corresponding to the file magic number, which improves the detection of the file to be uploaded. Whether the file passes the file upload vulnerability detection efficiency, and improves the success rate of file upload vulnerability detection.

[0080] It should be noted that, in other embodiments of the present application, the server may combine the file path, file name, and file name length of the file to be uploaded to determine whether to obtain the first file suffix of the file to be uploaded. At this time, the server only obtains the file to be uploaded when the file path of the file to be uploaded is a legal file path, the file name of the file to be uploaded is legal file name, and the length of the file name of the file to be uploaded is less than or equal to the preset length. The first file suffix, otherwise, the server determines that the file to be uploaded fails the file upload vulnerability detection, that is, the file path of the file to be uploaded is an illegal file path, the file name of the file to be uploaded is an illegal file name, and/or the file name of the file to be uploaded When the length of the file name is greater than the preset length, the server determines that the file to be uploaded fails the file upload vulnerability detection.

[0081] Further, after the server obtains the file to be uploaded, the server detects whether the file to be uploaded is a compressed file. Specifically, the server may determine whether the file to be uploaded is a compressed file through the file suffix of the file to be uploaded. For example, the suffix of the compressed file is RAR (Roshal ARchive) and ZIP etc. If the server determines that the file to be uploaded is a compressed file based on the file suffix of the file to be uploaded, the server determines whether the compression format corresponding to the file to be uploaded is allowed. If it is determined that the compression format corresponding to the file to be uploaded is allowed, the server will detect whether each file in the file to be uploaded passes the file upload vulnerability detection one by one according to the file detection method in this application, which improves the accuracy of the file upload vulnerability detection of compressed files . specifically , The allowed compression format is stored in the server in advance, and the allowed compression format can be set according to specific needs, and there is no specific restriction here.

[0082] Further, a fourth embodiment of the document detection method of the present application is proposed.

[0083] The difference between the fourth embodiment of the file detection method and the first, second or third embodiment of the file detection method is that the file detection method further includes:

[0084] Step j, if it is detected that the file magic number does not exist in the file to be uploaded, obtain a preset class function

[0085] Step k, if the object corresponding to the file to be uploaded is not generated through the class function, it is determined that the file to be uploaded has not passed the file upload vulnerability detection.

[0086] If the server detects that the file to be uploaded does not have a file magic number, the server obtains a preset class function, and executes the file to be uploaded in the class function to obtain the execution result. Among them, the class functions can be written by developers in languages such as Java or C++ (The C++ Programming Language/c plus plus) and stored in the server in advance. If the execution result is the object corresponding to the file to be uploaded, that is, the object corresponding to the file to be uploaded is generated through the class function, the server determines that the file to be uploaded passes the file upload vulnerability detection; if the execution result is not the object corresponding to the file to be uploaded, it passes the class The function does not generate an object corresponding to the file to be uploaded, and the server determines that the file to be uploaded fails the file upload vulnerability detection.

[0087] Further, if it is detected that there is no file magic number in the file to be uploaded, the server compares the file format of the file to be uploaded with the preset format blacklist. If the file format of the file to be uploaded is the same as the file format in the preset format blacklist, the server determines that the file to be uploaded fails the file upload vulnerability detection; if the file format of the file to be uploaded is different from the file format in the preset format blacklist , The server determines that the file to be uploaded passes the file upload vulnerability detection. Among them, the file format is a file indicating which format the file is, such as a PNG file or a TXT file. The preset format blacklist is pre-stored by the server.

[0088] In this embodiment, after detecting that the file to be uploaded does not have a file magic number, the preset class function is obtained. If the object corresponding to the file to be uploaded is not generated through the cold function, it is determined that the file to be uploaded does not pass the file upload vulnerability Detection further improves the success rate of file upload vulnerability detection.

[0089] Further, in order to facilitate the use of file detection methods for other vulnerability defense terminals, the file detection methods in this application can be written into SDK (Software Development Kit, software development kit) through object-oriented programming, and the SDK is generated by The library is output to other vulnerability prevention terminals for use. In the embodiments of the present application, the programming language corresponding to the object-oriented programming mode is not limited.

[0090] In addition, referring to FIG. 4, the present application also provides a file detection device, the file detection device includes: [0091] The acquisition module 10 is used to obtain the file to be uploaded after obtaining the file to be uploaded. The first file suffix;

[0092] The detection module 20 is configured to detect whether the file to be uploaded has a file magic number if the first file suffix is a legal file suffix;

[0093] The obtaining module 10 is further configured to obtain a second file suffix corresponding to the file magic number if there is a file magic number in the file to be uploaded;

[0094] The determining module 30 is configured to determine that the file to be uploaded fails the file upload vulnerability detection if the suffix of the first file is different from the suffix of the second file.

[0095] Further, the obtaining module 10 is also configured to obtain the file path and file name of the file to be uploaded after obtaining the file to be uploaded; if the file path is a legal file path, and the file name If it is a legal file name, the first file suffix of the file to be uploaded is obtained.

[0096] Further, the acquisition module 10 includes:

[0097] The first detection unit is configured to detect whether the file name length of the file to be uploaded is less than or equal to a preset length after the file to be uploaded is obtained;

[0098] The obtaining unit is configured to obtain the first file suffix of the file to be uploaded if the length of the file name is less than or equal to the preset length.

[0099] Further, the detection module 20 includes:

[0100] A reading unit, configured to read the file header of the file to be uploaded if the first file suffix is a legal file suffix;

[0101] The second detection unit is configured to detect whether the file header complies with a preset file magic number rule;

[0102] The determining unit is configured to, if it is detected that the file header meets the file magic number rule, determine that the file to be uploaded has a file magic number; if it is detected that the file header does not meet the file magic number rule , It is determined that there is no file magic number in the file to be uploaded.

[0103] Further, the obtaining module 10 is further configured to obtain a preset class function if it is detected that the file magic number does not exist in the file to be uploaded;

[0104] The determining module 30 is further configured to, if the object corresponding to the file to be uploaded is not generated through the class function, It is determined that the file to be uploaded fails the file upload vulnerability detection.

[0105] Further, the file detection device further includes:

[0106] The judging module is used to judge whether the first file suffix exists in the preset file suffix name array;

[0107] The determining module 30 is further configured to determine that the first file suffix is a legal file suffix if the first file suffix exists in the file suffix name array.

[0108] Further, the determining module 30 is also configured to determine that the first file suffix is an illegal file suffix if the first file suffix does not exist in the file suffix name array, and determine the first file suffix After a file suffix is an illegal file suffix, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[0109] Further, the determining module 30 is further configured to determine that the file to be uploaded fails the file upload vulnerability detection if it is detected that the file magic number does not exist in the file to be uploaded.

[0110] Further, the determining module 30 is further configured to determine that the file to be uploaded passes the file upload vulnerability detection if the suffix of the first file is the same as the suffix of the second file.

[0111] It should be noted that the various embodiments of the file detection device are basically the same as the embodiments of the above-mentioned file detection method, and will not be described in detail here.

[0112] In addition, this application also provides a file detection device. As shown in FIG. 5, FIG. 5 is a schematic structural diagram of the hardware operating environment involved in the solution of the embodiment of the present application.

[0113] It should be noted that FIG. 5 is a schematic structural diagram of the hardware operating environment of the file detection device. The file detection device in this application embodiment may be a terminal device such as a PC and a portable computer.

[0114] As shown in FIG. 5, the file detection device may include: a processor 1001, such as a CPU, a memory 1005, a user interface 1003, a network interface 1004, and a communication bus 1002. Among them, the communication bus 1002 is used to implement connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 can optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory, or a stable memory (non-volati le

memory), such as disk storage. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0115] Optionally, the file detection device may also include a camera, an RF (Radio Frequency, radio frequency) Circuits, sensors, audio circuits, WiFi modules, etc.

[0116] Those skilled in the art can understand that the structure of the file detection device shown in FIG. 5 does not constitute a limitation on the file detection device, and may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.

[0117] As shown in FIG. 5, the memory 1005, which is a computer storage medium, may include an operating system, a network communication module, a user interface module, and a file detection program. Among them, the operating system is a program that manages and controls the hardware and software resources of the file detection device, and supports the operation of the file detection program and other software or programs.

[0118] In the file detection device shown in FIG. 5, the user interface 1003 is mainly used to connect to the client (user side)

, Perform data communication with the client; the network interface 1004 is mainly used to connect to the background server, and perform data communication with the background server; the processor 1001 can be used to call the file detection program stored in the memory 1005 and execute the file detection method described above A step of.

[0119] The specific implementation manner of the document detection device of the present application is basically the same as each embodiment of the above-mentioned document detection method, and will not be repeated here.

[0120] In addition, an embodiment of the present application also proposes a computer-readable storage medium having a file detection program stored on the computer-readable storage medium, and when the file detection program is executed by a processor, the file detection as described above is realized Method steps.

[0121] The specific implementation of the computer-readable storage medium of the present application is basically the same as each embodiment of the above-mentioned file detection method, and will not be repeated here.

[0122] It should be noted that in this article, the terms "including", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes Those elements also include other elements that are not explicitly listed, or also include elements inherent to the process, method, article, or device. Without more restrictions, the element defined by the phrase "including one" does not exclude the existence of other same elements in the process, method, article, or device that includes the element.

[0123] The sequence numbers of the foregoing embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0124] Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general hardware platform, and of course, they can also be implemented by hardware. But in many cases, the former is a better implementation. Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes a number of instructions to enable a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the method described in each embodiment of the present application.

[0125] The above are only preferred embodiments of the application, and do not limit the scope of the application. Any equivalent structure or equivalent process transformation made by using the description and drawings of the application, or directly or indirectly applied to other related In the same way, the technical fields of are included in the scope of patent protection of this application.

Claims

Claims

[Claim 1] A file detection method, wherein the file detection method includes the following steps:

After obtaining the file to be uploaded, obtain the first file suffix of the file to be uploaded; if the first file suffix is a legal file suffix, detecting whether the file to be uploaded has a file magic number;

If the file to be uploaded has a file magic number, acquiring the second file suffix corresponding to the file magic number;

If the suffix of the first file is different from the suffix of the second file, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[Claim 2] The file detection method according to claim 1, wherein after the file to be uploaded is obtained, the step of obtaining the first file suffix of the file to be uploaded comprises:

When the file to be uploaded is obtained, the file path and file name of the file to be uploaded are obtained; if the file path is a legal file path and the file name is a legal file name, the first file name of the file to be uploaded is obtained A file suffix.

[Claim 3] The file detection method according to claim 1, wherein, after the file to be uploaded is obtained, the step of obtaining the first file suffix of the file to be uploaded comprises:

After obtaining the file to be uploaded, detecting whether the length of the file name of the file to be uploaded is less than or equal to the preset length;

If the length of the file name is less than or equal to the preset length, obtaining the first file suffix of the file to be uploaded.

[Claim 4] The file detection method of claim 1, wherein, if the first file suffix is a legal file suffix, the step of detecting whether the file to be uploaded has a file magic number includes:

If the first file suffix is a legal file suffix, read the file header of the file to be uploaded;

Detecting whether the file header complies with a preset file magic number rule; if it is detected that the file header complies with the file magic number rule, determining that the file to be uploaded has a file magic number; If it is detected that the file header does not comply with the file magic number rule, it is determined that the file to be uploaded does not have a file magic number.

[Claim 5] The file detection method according to claim 1, wherein if the first file suffix is a legal file suffix, after the step of detecting whether the file to be uploaded has a file magic number, the method further comprises :

If it is detected that the file magic number does not exist in the file to be uploaded, a preset class function is obtained. If the object corresponding to the file to be uploaded is not generated through the class function, it is determined that the file to be uploaded does not pass the file Upload vulnerability detection.

[Claim 6] The file detection method according to claim 1, wherein, if the first file suffix is a legal file suffix, before the step of detecting whether the file to be uploaded has a file magic number, the method further comprises :

Determine whether the first file suffix exists in the preset file suffix name array; if the first file suffix exists in the file suffix name array, determine that the first file suffix is a legal file suffix.

[Claim 7] The file detection method according to claim 6, wherein after the step of determining whether the first file suffix exists in the preset file suffix name array, the method further comprises: if the file suffix name is If the first file suffix does not exist in the array, it is determined that the first file suffix is an illegal file suffix, and after determining that the first file suffix is an illegal file suffix, it is determined that the file to be uploaded fails the file upload vulnerability detection .

[Claim 8] The file detection method of claim 1, wherein, if the first file suffix is a legal file suffix, after the step of detecting whether the file to be uploaded has a file magic number, the method further comprises :

If it is detected that the file magic number does not exist in the file to be uploaded, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[Claim 9] The file detection method according to claim 1, wherein, after the step of obtaining a second file suffix corresponding to the file magic number if the file to be uploaded has a file magic number, the method further comprises : If the suffix of the first file is the same as the suffix of the second file, it is determined that the file to be uploaded passes the file upload vulnerability detection.

[Claim 10] A file detection device, wherein the file detection device comprises:

The obtaining module is used to obtain the first file suffix of the file to be uploaded after the file to be uploaded is obtained;

A detection module, configured to detect whether the file to be uploaded has a file magic number if the first file suffix is a legal file suffix;

The obtaining module is further configured to obtain a second file suffix corresponding to the file magic number if there is a file magic number in the file to be uploaded;

The determining module is configured to determine that the file to be uploaded fails the file upload vulnerability detection if the suffix of the first file is different from the suffix of the second file.

[Claim 11] The file detection device according to claim 10, wherein the obtaining module is further configured to obtain the file path and file name of the file to be uploaded after obtaining the file to be uploaded; if the file If the path is a legal file path, and the file name is a legal file name, then the first file suffix of the file to be uploaded is obtained.

[Claim 12] The file detection device according to claim 10, wherein the acquisition module comprises: a first detection unit, configured to detect whether the file name length of the file to be uploaded is Less than or equal to the preset length;

The obtaining unit is configured to obtain the first file suffix of the file to be uploaded if the length of the file name is less than or equal to the preset length.

[Claim 13] The file detection device according to claim 10, wherein the detection module comprises: a reading unit, configured to read the file to be uploaded if the suffix of the first file is a legal file suffix The file header;

The second detection unit is configured to detect whether the file header complies with a preset file magic number rule; the determining unit is configured to determine that the file to be uploaded exists if it is detected that the file header complies with the file magic number rule File magic number; if it is detected that the file header does not meet the file magic number rule, it is determined that there is no file magic number in the file to be uploaded.

[Claim 14] The file detection device according to claim 10, wherein the acquisition module is further configured to It is detected that the file magic number does not exist in the file to be uploaded, then a preset class function is obtained; the determining module is further configured to determine that if the object corresponding to the file to be uploaded is not generated by the class function The file to be uploaded fails the file upload vulnerability detection.

[Claim 15] The file detection device according to claim 10, wherein the determining module is configured to determine whether the first file suffix exists in the preset file suffix name array; and the determining module is also configured to: If the first file suffix exists in the file suffix name array, it is determined that the first file suffix is a legal file suffix.

[Claim 16] The file detection device according to claim 15, wherein the determining module is further configured to determine the first file suffix if the first file suffix does not exist in the file suffix name array Is an illegal file suffix, and after determining that the first file suffix is an illegal file suffix, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[Claim 17] The file detection device according to claim 10, wherein the determining module is further configured to determine that the file to be uploaded does not pass if it is detected that the file magic number does not exist in the file to be uploaded File upload vulnerability detection.

[Claim 18] The file detection device according to claim 10, wherein the determining module is further configured to determine that the file to be uploaded passes the file if the suffix of the first file is the same as the suffix of the second file. Upload vulnerability detection.

[Claim 19] A file detection device, wherein the file detection device includes a memory, a processor, and a file detection program stored on the memory and capable of running on the processor, and the file detection program is When the processor executes, the following steps are implemented: after the file to be uploaded is obtained, the first file suffix of the file to be uploaded is obtained; if the first file suffix is a legal file suffix, it is detected whether the file to be uploaded is There is a file magic number;

If the file to be uploaded has a file magic number, acquiring the second file suffix corresponding to the file magic number;

If the suffix of the first file is different from the suffix of the second file, it is determined that the file to be uploaded fails the file upload vulnerability detection.

[Claim 20] A computer-readable storage medium, wherein the computer-readable storage medium stores A file detection program, when the file detection program is executed by a processor, the following steps are implemented: after the file to be uploaded is obtained, the first file suffix of the file to be uploaded is obtained; if the first file suffix is a legal file suffix, Then detect whether the file to be uploaded has a file magic number;

If the file to be uploaded has a file magic number, acquiring the second file suffix corresponding to the file magic number;

If the suffix of the first file is different from the suffix of the second file, it is determined that the file to be uploaded fails the file upload vulnerability detection.