关于上传文件验证是否安全

  protected void Button1_Click(object sender, EventArgs e)
        {
            string str = FileUpload1.PostedFile.ContentType;
            Response.Write("文件类型：" + str);

            string filename = "";

            FileExtension[] fe = { FileExtension.GIF, FileExtension.JPG, FileExtension.PNG };
            if (FileValidation.IsAllowedExtension(FileUpload1, fe))
            {
                string fileExt = System.IO.Path.GetExtension(FileUpload1.FileName).ToLower();
                Response.Write("<br>验证通过！");
                //filename = "/Images/" + DateTime.Now.ToString("yyyyMMddHHmmss") + fileExt; 
                //FileUpload1.PostedFile.SaveAs(Server.MapPath(filename)); 
            }
            else
            {
                Response.Write("<br>验证不通过，只支持以下格式的图片：JPG,GIF,PNG");
                return;
            } 
        }

 

  public enum FileExtension
    {
        JPG = 255216,
        GIF = 7173,
        PNG = 13780,
        SWF = 6787,
        RAR = 8297,
        ZIP = 8075,
        _7Z = 55122

        // 255216 jpg; 

        // 7173 gif; 

        // 6677 bmp, 

        // 13780 png; 

        // 6787 swf 

        // 7790 exe dll, 

        // 8297 rar 

        // 8075 zip 

        // 55122 7z 

        // 6063 xml 

        // 6033 html 

        // 239187 aspx 

        // 117115 cs 

        // 119105 js 

        // 102100 txt 

        // 255254 sql  

    }

    public class FileValidation
    {
        public static bool IsAllowedExtension(FileUpload fu, FileExtension[] fileEx)
        {
            int fileLen = fu.PostedFile.ContentLength;
            byte[] imgArray = new byte[fileLen];
            fu.PostedFile.InputStream.Read(imgArray, 0, fileLen);
            MemoryStream ms = new MemoryStream(imgArray);
            System.IO.BinaryReader br = new System.IO.BinaryReader(ms);
            string fileclass = "";
            byte buffer;
            try
            {
                buffer = br.ReadByte();
                fileclass = buffer.ToString();
                buffer = br.ReadByte();
                fileclass += buffer.ToString();
            }
            catch
            {
            }
            br.Close();
            ms.Close();
            foreach (FileExtension fe in fileEx)
            {
                if (Int32.Parse(fileclass) == (int)fe)
                    return true;
            }
            return false;
        }
    }