Posted by Thor (Hammer of God) on Jun 24
It all depends on how the files are being validated, but I would guess for IIS6,7 the use of a
RegularExpressionValidator would be run against the upload control with whatever ValidationExpression would be in place
given how easy it is to implement. That would ensure the filetype extension was .jpg directly in the upload control.
There wouldn't be any "bypass" via the control – you'd have to go around the control somehow….
Source: Re: ASHX, ASMX or What?