Validate file type rails

The validation proposed in this gist will check the file after it is uploaded. This might be a problem especially when using a paid cloud service. The following is another method, that doesn't send the file over to the cloud service at all.

I don't really like it, and it probably breaks the MVC, but I'm not sure there is another way if we don't want the file to be sent. So what I've done in my case, is validate in the controller. Yes, it's weird. But even calling object. The controller can use this contant then and check with the param[:file]. The controller can then add errors on the object without assigning anything to the file field. I came across dozens of replies suggesting validating with document. The only place capable of doing validation in that scenario is in JS on the upload side, and that's generally a bad idea unless you trust your users because they could disable or tamper with the JS validation.

Here's a tough one I've had a client able to bypass content type security like the above with. Basically, they were able to upload a. I don't think content type mime type checking is good enough to securely validate files.

Only client side validation is not enough, people can easily bypass it. We need to add the same validations to the server side. For Rails applications, the common way is set it up in the model. Next, add a custom validator for file size validation. Inside of your User model , add the following code:.

See examples below taken from here. Using accept attribute instead of checking every file manually and then adding it to the list speeded my work.

I didn't have to throw an error every time wrong file is added and explain to the user what he or she should do now. That's true that accept attribute doesn't allow user to select file with type I didn't specify but you know This is why I decided to add one more step before adding files to the list and wrote the function checking if selected file type is included in the extensions whitelist I have in the app. If it is not there - nothing happens no error for the user is needed as this is edge case only if someone compromises the form.

And the app is safe. The user does not even need to use a browser to upload to your server, they could use curl or write a script in order to upload files. Checking the file type by extension may not suffice then, so be sure to check the content for type signatures e. Rails how to validate file format? Ask Question. Asked 10 years, 3 months ago. Active 10 years, 3 months ago. Viewed 13k times.

How do I validate my file fields for the correct format? I want the image field to validate that it is a. And the flv that it has the ending. Rails beginner. Rails beginner Rails beginner I don't know rails, so leaving this as a comment, but this link may be of interest: groups.

Also, I would suggest removing the stuff about file extensions.