Flask-Uploads:如何通过内容(而不仅仅是扩展名)强制文件类型

Question

我正在使用Flask-Uploads来处理web应用程序中的图像上传。web应用程序只接受JPEG图像，但似乎Flask-Uploads只通过检查文件扩展名来执行此操作。

例如，我可以很容易地将文件名从myfile.txt更改为myfile.jpg，这样文本文件myfile.txt就会被错误地接受为JPEG图像。

如何确保上传到我的web应用程序的文件实际上是按内容而不是仅按文件扩展名的JPEG文件？

下面是一个最小的实现(不包括模板)，它演示了我想要做的事情：

# __init__.py

from flask import Flask
from flask_uploads import UploadSet, configure_uploads, IMAGES
from config import Config

app = Flask(__name__)
app.config.from_object(Config)

photos = UploadSet("photos", IMAGES)
configure_uploads(app, photos)

from app import routes

# routes.py

import os
from flask import redirect, render_template, send_from_directory, url_for
from flask_uploads import UploadNotAllowed
from app import app, photos
from app.forms import PhotoForm


@app.route('/', methods=["GET", "POST"])
def index():
    form = PhotoForm()
    if form.validate_on_submit():
        try:
            filename = photos.save(form.photo.data)
            return redirect(url_for("uploaded_file", filename=filename))
        except UploadNotAllowed:
            print("UploadNotAllowed!")
            redirect(url_for("index"))
    return render_template("index.html", form=form)


@app.route("/uploads/<filename>")
def uploaded_file(filename):
    directory = os.path.join(os.getcwd(), app.config["UPLOADED_PHOTOS_DEST"])
    return send_from_directory(directory, filename)

# forms.py

from flask_wtf import FlaskForm
from flask_wtf.file import FileField, FileRequired
from wtforms import SubmitField


class PhotoForm(FlaskForm):
    photo = FileField(validators=[FileRequired()])
    submit = SubmitField("Upload")

# config.py

import os


class Config(object):
    SECRET_KEY = os.environ.get("SECRET_KEY")
    UPLOADED_PHOTOS_DEST = "uploads"
    UPLOADED_PHOTOS_DENY = ["bmp", "gif", "png", "svg"]

Answer 1

您可以导入UploadSet并-如文档字符串中所述-覆盖file_allowed方法，例如创建自己的类，继承UploadSet。

然后，您可以从几个Python库中选择一个，它可以检测类型，例如https://github.com/ahupp/python-magic

附言:至少在PyPi包中，Flask-Uploads在2020年2月就已经崩溃了。我创建了一个fork，这是一个可以通过https://pypi.org/project/Flask-Reuploaded/下载的替代工具