关于图片上传的验证问题

Question

图片上传事件：
中间有图片校验的验证 但是还有网友上传.ini文件，实在不解
以下是代码大家帮我看看        protected void btnUploadAdd_Click(object sender, EventArgs e)
        {
            if (!fileADD.HasFile)
            {
                return;
            }
            if (myStringUtils.IsImage(Path.GetExtension(fileADD.FileName)))//验证是否是图片
            {
                if (data == null)
                {
                    data = new UserImageData();
                }
                else
                {
                    DelteFile();
                }
                StringBuilder imgpath = new StringBuilder();
                imgpath.Append(@"/Upload/");
                imgpath.Append(ConstData.DateTimeNow.ToString(@"yyyy/MM/dd").Replace("-", "/"));
                imgpath.Append(@"/");
                imgpath.Append(ConstData.DateTimeNow.ToString("yyyyMMddHHmmssffff"));
                string strfilname = System.IO.Path.GetExtension(fileADD.FileName);
                data.Path = imgpath.ToString() + strfilname;
                data.Status = (int)ConstData.StatusImage.等待审核;
                data.AddDate = ConstData.DateTimeNow;                DirectoryInfo dir = new DirectoryInfo(Request.PhysicalApplicationPath + data.Path.Remove(data.Path.LastIndexOf('/')));
                if (!dir.Exists)
                {
                    dir.Create();
                }
                fileADD.PostedFile.SaveAs(Server.MapPath(data.Path));
                             if (data.AutoID != 0)
                {
                    myUserImageService.Update(data);
                }
                else
                {                    data.AlbumID = 0;
                    data.UserID = myUserContext.UserID;
                    myUserImageService.Add(data);
                }
                imgUser.ImageUrl = "~" + data.Path;
                lbStatus.Text = ((ConstData.StatusImage)data.Status).ToString();
                Server.Transfer("Success.aspx?Success=上传成功");
            }
            else
            {
                mg.Show(this, "只能上传gif或者jpg格式的图片");
            }
        }
//图片验证方法
        private static Regex regImage = new Regex(@"^(.jpg||.gif)$", RegexOptions.IgnoreCase);
        public bool IsImage(string str)
        {            if (str.Length < 4)
            {
                return false;
            }
            else
            {
                return regImage.IsMatch(str.Substring(0, (str.Length - 4)));
            }        }

Answer 1

201004280229068933.ini  这样的文件居然能上传
经过测试 private static Regex regImage = new Regex(@"^(.jpg||.gif)$", RegexOptions.IgnoreCase);
        public bool IsImage(string str)
        {            if (str.Length < 4)
            {
                return false;
            }
            else
            {
                return regImage.IsMatch(str.Substring(0, (str.Length - 4)));
            }        }
验证的结果居然是ture

Answer 2

而我的验证方法只能上传gif或者jpg格式的图片 其他则为非法的

Answer 3

fileinfo不是直接有判断后缀名的方法么？

Answer 4

file.FullName.LastIndexOf(".")) == ".gif"