Question

In my web application I have an image uploading module. I want to check the uploaded file whether it’s an image file or any other file. I am using Java in server side.

The image is read as BufferedImage in java and then I am writing it to disk with ImageIO.write()

How shall I check the BufferedImage, whether it’s really an image or something else?

Any suggestions or links would be appreciated.

Answer 1

I’m assuming that you’re running this in a servlet context. If it’s affordable to check the content type based on just the file extension, then use ServletContext#getMimeType() to get the mime type (content type). Just check if it starts with image/.

String fileName = uploadedFile.getFileName();
String mimeType = getServletContext().getMimeType(fileName);
if (mimeType.startsWith("image/")) {
    // It's an image.
} else {
    // It's not an image.
}

The default mime types are definied in the web.xml of the servletcontainer in question. In for example Tomcat, it’s located in /conf/web.xml. You can extend/override it in the /WEB-INF/web.xml of your webapp as follows:

<mime-mapping>
    <extension>svg</extension>
    <mime-type>image/svg+xml</mime-type>
</mime-mapping>

But this doesn’t prevent you from users who are fooling you by changing the file extension. If you’d like to cover this as well, then you can also determine the mime type based on the actual file content. If it’s affordable to check for only BMP, GIF, JPEG, PNG, TIFF or WBMP types (but not PSD, SVG, etc), then you can just feed it directly to ImageIO#read() and check if it doesn’t throw an exception.

try (InputStream input = uploadedFile.getInputStream()) {
    try {
        ImageIO.read(input).toString();
        // It's an image (only BMP, GIF, JPEG, PNG, TIFF and WBMP are recognized).
    } catch (Exception e) {
        // It's not an image.
    }
}

But if you’d like to cover more image types as well, then consider using a 3rd party library which does all the work by sniffing the file signatures. For example Apache Tika which recognizes on top of ImageIO formats also PSD, BPG, WEBP, ICNS and SVG as well:

Tika tika = new Tika();
try (InputStream input = uploadedFile.getInputStream()) {
    String mimeType = tika.detect(input);
    if (mimeType.startsWith("image/")) {
        // It's an image.
    } else {
        // It's not an image.
    }
}

You could if necessary use combinations and outweigh the one and other.

That said, you don’t necessarily need ImageIO#write() to save the uploaded image to disk. Just writing the obtained InputStream directly to a Path or any OutputStream like FileOutputStream the usual Java IO way is more than sufficient (see also Recommended way to save uploaded files in a servlet application):

try (InputStream input = uploadedFile.getInputStream()) {
    Files.copy(input, new File(uploadFolder, fileName).toPath());
}

Unless you’d like to gather some image information like its dimensions and/or want to manipulate it (crop/resize/rotate/convert/etc) of course.