40 lines
1.9 KiB
C#
40 lines
1.9 KiB
C#
using System.Collections.Frozen;
|
|
|
|
namespace DataTransfer.Client.Services;
|
|
|
|
/// <summary>
|
|
/// File types that can run code when opened, or are commonly used to deliver malware or phishing. Common archives
|
|
/// (zip, 7z, rar) and documents are deliberately not listed, so the warning stays meaningful.
|
|
/// </summary>
|
|
public static class RiskyFileTypes
|
|
{
|
|
private static readonly FrozenSet<string> Extensions = new[]
|
|
{
|
|
// Windows programs and installers
|
|
"exe", "com", "scr", "pif", "cpl", "msi", "msix", "msixbundle", "msp", "appx", "appxbundle", "appref-ms",
|
|
"application", "gadget", "dll", "sys", "drv", "ocx",
|
|
|
|
// Scripts
|
|
"bat", "cmd", "ps1", "psm1", "vbs", "vbe", "js", "jse", "mjs", "wsf", "wsh", "wsc", "sct", "hta", "jar", "py",
|
|
"pyw", "sh", "bash", "command", "applescript", "scpt", "reg", "inf", "msc",
|
|
|
|
// Shortcuts and shell files that can launch programs
|
|
"lnk", "url", "scf", "library-ms", "search-ms", "settingcontent-ms",
|
|
|
|
// macOS and Linux applications and packages
|
|
"app", "pkg", "mpkg", "dmg", "workflow", "action", "deb", "rpm", "appimage", "run", "bin",
|
|
|
|
// Disk images, often used to bypass download protection
|
|
"iso", "img", "vhd", "vhdx",
|
|
|
|
// Office documents with macros, add-ins and other formats abused for malware
|
|
"docm", "dotm", "xlsm", "xltm", "xlam", "xll", "pptm", "potm", "ppam", "ppsm", "sldm", "one", "chm",
|
|
|
|
// Web pages opened from disk, a common way to deliver phishing
|
|
"htm", "html", "xhtml", "mht", "mhtml"
|
|
}.ToFrozenSet(StringComparer.OrdinalIgnoreCase);
|
|
|
|
/// <summary>Only the last extension counts, so <c>invoice.pdf.exe</c> is risky and <c>setup.exe.txt</c> is not.</summary>
|
|
public static bool IsRisky(string? fileName) =>
|
|
Path.GetExtension(fileName) is { Length: > 1 } extension && Extensions.Contains(extension[1..]);
|
|
}
|