Java校验图片是否被篡改文件类型

在Java中校验图片是否被篡改文件类型（即文件实际内容与扩展名是否匹配），主要有以下几种方法：

1. 使用魔数（Magic Number）检测

每种图片格式都有特定的文件头签名（魔数），可以通过读取文件头部字节进行验证：

import java.io.FileInputStream;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

public class ImageValidator {
    
    // 常见图片格式的魔数字典
    private static final Map<String, String> MAGIC_NUMBERS = new HashMap<>();
    
    static {
        MAGIC_NUMBERS.put("FFD8FF", "jpg");
        MAGIC_NUMBERS.put("89504E47", "png");
        MAGIC_NUMBERS.put("47494638", "gif");
        MAGIC_NUMBERS.put("424D", "bmp");
        MAGIC_NUMBERS.put("52494646", "webp"); // WEBP: RIFF
        MAGIC_NUMBERS.put("49492A00", "tiff");
        MAGIC_NUMBERS.put("4D4D002A", "tiff");
    }
    
    /**
     * 通过魔数验证文件真实类型
     */
    public static String getRealFileType(byte[] fileBytes) {
        if (fileBytes == null || fileBytes.length < 4) {
            return "unknown";
        }
        
        // 读取前4个字节并转换为十六进制
        StringBuilder hexBuilder = new StringBuilder();
        for (int i = 0; i < Math.min(4, fileBytes.length); i++) {
            hexBuilder.append(String.format("%02X", fileBytes[i]));
        }
        String fileHeader = hexBuilder.toString();
        
        // 检查匹配的魔数
        for (Map.Entry<String, String> entry : MAGIC_NUMBERS.entrySet()) {
            if (fileHeader.startsWith(entry.getKey())) {
                return entry.getValue();
            }
        }
        
        return "unknown";
    }
    
    /**
     * 验证文件扩展名是否与真实类型匹配
     */
    public static boolean validateImageFile(String filePath) throws IOException {
        try (FileInputStream fis = new FileInputStream(filePath)) {
            byte[] header = new byte[8];
            int read = fis.read(header);
            
            if (read < 4) {
                return false;
            }
            
            String realType = getRealFileType(header);
            String extension = getFileExtension(filePath).toLowerCase();
            
            return realType.equalsIgnoreCase(extension);
        }
    }
    
    private static String getFileExtension(String filename) {
        int dotIndex = filename.lastIndexOf('.');
        if (dotIndex > 0 && dotIndex < filename.length() - 1) {
            return filename.substring(dotIndex + 1);
        }
        return "";
    }
    
    // 使用示例
    public static void main(String[] args) {
        try {
            String filePath = "example.jpg";
            boolean isValid = validateImageFile(filePath);
            
            if (isValid) {
                System.out.println("文件类型验证通过");
            } else {
                System.out.println("警告：文件可能被篡改！");
            }
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

2. 使用Apache Tika库

Apache Tika是一个内容检测和分析工具包，可以更准确地检测文件类型：

import org.apache.tika.Tika;
import org.apache.tika.mime.MediaType;
import java.io.File;
import java.io.IOException;

public class TikaImageValidator {
    
    private static final Tika tika = new Tika();
    
    /**
     * 使用Tika检测文件真实类型
     */
    public static boolean validateWithTika(String filePath) throws IOException {
        File file = new File(filePath);
        
        // 检测真实MIME类型
        String detectedType = tika.detect(file);
        String extension = getFileExtension(filePath);
        
        // 将扩展名映射为MIME类型进行比较
        String expectedMimeType = getMimeTypeFromExtension(extension);
        
        return detectedType.equalsIgnoreCase(expectedMimeType);
    }
    
    private static String getMimeTypeFromExtension(String extension) {
        switch (extension.toLowerCase()) {
            case "jpg":
            case "jpeg":
                return "image/jpeg";
            case "png":
                return "image/png";
            case "gif":
                return "image/gif";
            case "bmp":
                return "image/bmp";
            case "webp":
                return "image/webp";
            case "tiff":
            case "tif":
                return "image/tiff";
            default:
                return "application/octet-stream";
        }
    }
    
    // 其他辅助方法同上
}

3. 完整的验证工具类

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

public class ComprehensiveImageValidator {
    
    private static final Map<String, String[]> MAGIC_NUMBERS = new HashMap<>();
    
    static {
        MAGIC_NUMBERS.put("jpg", new String[]{"FFD8FF"});
        MAGIC_NUMBERS.put("jpeg", new String[]{"FFD8FF"});
        MAGIC_NUMBERS.put("png", new String[]{"89504E47"});
        MAGIC_NUMBERS.put("gif", new String[]{"47494638"});
        MAGIC_NUMBERS.put("bmp", new String[]{"424D"});
        MAGIC_NUMBERS.put("webp", new String[]{"52494646"}); // RIFF header
        MAGIC_NUMBERS.put("tiff", new String[]{"49492A00", "4D4D002A"});
    }
    
    /**
     * 综合验证方法
     */
    public static ValidationResult validateImage(String filePath) throws IOException {
        File file = new File(filePath);
        String extension = getFileExtension(filePath).toLowerCase();
        
        // 读取文件头
        byte[] header = readFileHeader(file, 8);
        String realType = detectRealType(header);
        
        ValidationResult result = new ValidationResult();
        result.setFileName(file.getName());
        result.setDeclaredExtension(extension);
        result.setRealType(realType);
        result.setValid(realType.equalsIgnoreCase(extension));
        
        return result;
    }
    
    private static byte[] readFileHeader(File file, int length) throws IOException {
        try (FileInputStream fis = new FileInputStream(file)) {
            byte[] header = new byte[length];
            int read = fis.read(header);
            return Arrays.copyOf(header, read);
        }
    }
    
    private static String detectRealType(byte[] header) {
        if (header.length < 4) return "unknown";
        
        StringBuilder hexBuilder = new StringBuilder();
        for (int i = 0; i < Math.min(8, header.length); i++) {
            hexBuilder.append(String.format("%02X", header[i]));
        }
        String fileHeader = hexBuilder.toString();
        
        for (Map.Entry<String, String[]> entry : MAGIC_NUMBERS.entrySet()) {
            for (String magic : entry.getValue()) {
                if (fileHeader.startsWith(magic)) {
                    return entry.getKey();
                }
            }
        }
        
        return "unknown";
    }
    
    public static class ValidationResult {
        private String fileName;
        private String declaredExtension;
        private String realType;
        private boolean isValid;
        
        // getters and setters
        public boolean isValid() { return isValid; }
        public String getRealType() { return realType; }
        // ... 其他getter/setter
    }
    
    private static String getFileExtension(String filename) {
        int dotIndex = filename.lastIndexOf('.');
        return (dotIndex == -1) ? "" : filename.substring(dotIndex + 1);
    }
}

使用建议

1. 魔数检测：简单快速，适合基本验证

2. Apache Tika：更准确，支持更多文件类型，但需要额外依赖

3. 组合使用：可以先进行魔数快速检测，失败时再使用Tika进行深度检测

4. 安全性：对于安全敏感场景，建议结合文件大小、尺寸等额外验证

使用上面的两种方式可以有效检测常见的图片文件类型篡改，如将可执行文件重命名为图片扩展名等安全威胁。