for (FileItem file : files) {
// Checks to make sure the file's content type is valid
String groupsPattern = Settings.get(String.class, "cms/tool/fileContentTypeGroups");
Set<String> contentTypeGroups = new SparseSet(ObjectUtils.isBlank(groupsPattern) ? "+/" : groupsPattern);
if (!contentTypeGroups.contains(file.getContentType())) {
page.getErrors().add(new IllegalArgumentException(String.format(
"Invalid content type [%s]. Must match the pattern [%s].",
file.getContentType(), contentTypeGroups)));
continue;
}
// Disallow HTML disguising as other content types per:
// http://www.adambarth.com/papers/2009/barth-caballero-song.pdf
if (!contentTypeGroups.contains("text/html")) {
InputStream input = file.getInputStream();
try {
byte[] buffer = new byte[1024];
String data = new String(buffer, 0, input.read(buffer)).toLowerCase(Locale.ENGLISH);