php - Is it important to verify that the uploaded file is an actual image file?

Question

Let's say you could upload any file you wished to a server, but the file extension MUST be ".jpg". Would you be able to upload anything that could harm the server?

The point of my question is that file type verification is slow, and I would rather only have to check the file extension if that is secure enough. I am having trouble imagining a scenario where malware disguised as an image could be used.

I have seen recommendations for using getimagesize() to verify an image, but this function is pretty slow, and I cannot figure out if it is necessary, or even effective, for preventing malware uploads...

Any information on this is greatly appreciated.

Answer 1

For testing the security of images, I really only use one method: just re-create the image with GD or whatever image processing library you're using, and use the new image.

This should make the file perfectly secure if you have updated versions of your library.

It may make your stuff a bit slower, but the safer the better.

Just checking if there is a '.jpg' at the end of a file name will do nothing. The file can still be any type of file.

Hope this helped!