Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[5.4] Prevent PHP file extensions uploads by default unless explicitly allowed #20392

Merged
merged 5 commits into from
Aug 2, 2017
Merged

[5.4] Prevent PHP file extensions uploads by default unless explicitly allowed #20392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
04d8928
inital
laurencei Aug 2, 2017
f2caac7
style fix
laurencei Aug 2, 2017
22cc0b7
style fix
laurencei Aug 2, 2017
7f29771
fix block
laurencei Aug 2, 2017
9e19b4e
Update ValidatesAttributes.php
taylorotwell Aug 2, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions src/Illuminate/Validation/Concerns/ValidatesAttributes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -917,6 +917,10 @@ protected function validateMimes($attribute, $value, $parameters)
return false;
}

if ($this->shouldBlockPhpUpload($value, $parameters)) {
return false;
}

return $value->getPath() != '' && in_array($value->guessExtension(), $parameters);
}

Expand All @@ -934,11 +938,31 @@ protected function validateMimetypes($attribute, $value, $parameters)
return false;
}

if ($this->shouldBlockPhpUpload($value, $parameters)) {
return false;
}

return $value->getPath() != '' &&
(in_array($value->getMimeType(), $parameters) ||
in_array(explode('/', $value->getMimeType())[0].'/*', $parameters));
}

/**
* Check if PHP uploads are explicitly allowed.
*
* @param mixed $value
* @param array $parameters
* @return bool
*/
protected function shouldBlockPhpUpload($value, $parameters)
{
if (in_array('php', $parameters)) {
return false;
}

return strtolower($value->getExtension()) === 'php';
}

/**
* Validate the size of an attribute is greater than a minimum value.
*
Expand Down
69 changes: 52 additions & 17 deletions tests/Validation/ValidationValidatorTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1950,37 +1950,55 @@ public function testValidateImage()
$trans = $this->getIlluminateArrayTranslator();
$uploadedFile = [__FILE__, '', null, null, null, true];

$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('php'));
$file->expects($this->any())->method('getExtension')->will($this->returnValue('php'));
$v = new Validator($trans, ['x' => $file], ['x' => 'Image']);
$this->assertFalse($v->passes());

$file2 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file2 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file2->expects($this->any())->method('guessExtension')->will($this->returnValue('jpeg'));
$file2->expects($this->any())->method('getExtension')->will($this->returnValue('jpeg'));
$v = new Validator($trans, ['x' => $file2], ['x' => 'Image']);
$this->assertTrue($v->passes());

$file3 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file3 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file3->expects($this->any())->method('guessExtension')->will($this->returnValue('gif'));
$file3->expects($this->any())->method('getExtension')->will($this->returnValue('gif'));
$v = new Validator($trans, ['x' => $file3], ['x' => 'Image']);
$this->assertTrue($v->passes());

$file4 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file4 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file4->expects($this->any())->method('guessExtension')->will($this->returnValue('bmp'));
$file4->expects($this->any())->method('getExtension')->will($this->returnValue('bmp'));
$v = new Validator($trans, ['x' => $file4], ['x' => 'Image']);
$this->assertTrue($v->passes());

$file5 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file5 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file5->expects($this->any())->method('guessExtension')->will($this->returnValue('png'));
$file5->expects($this->any())->method('getExtension')->will($this->returnValue('png'));
$v = new Validator($trans, ['x' => $file5], ['x' => 'Image']);
$this->assertTrue($v->passes());

$file6 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file6 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file6->expects($this->any())->method('guessExtension')->will($this->returnValue('svg'));
$file6->expects($this->any())->method('getExtension')->will($this->returnValue('svg'));
$v = new Validator($trans, ['x' => $file6], ['x' => 'Image']);
$this->assertTrue($v->passes());
}

public function testValidateImageDoesNotAllowPhpExtensionsOnImageMime()
{
$trans = $this->getIlluminateArrayTranslator();
$uploadedFile = [__FILE__, '', null, null, null, true];

$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('jpeg'));
$file->expects($this->any())->method('getExtension')->will($this->returnValue('php'));
$v = new Validator($trans, ['x' => $file], ['x' => 'Image']);
$this->assertFalse($v->passes());
}

/**
* @group dimension
*/
Expand Down Expand Up @@ -2062,16 +2080,14 @@ public function testValidateImageDimensions()
/**
* @requires extension fileinfo
*/
public function testValidateMimetypes()
public function testValidatePhpMimetypes()
{
$trans = $this->getIlluminateArrayTranslator();
$uploadedFile = [__FILE__, '', null, null, null, true];

$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('php'));

$v = new Validator($trans, ['x' => $file], ['x' => 'mimetypes:text/x-php']);
$this->assertTrue($v->passes());
$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('rtf'));
$file->expects($this->any())->method('getExtension')->will($this->returnValue('rtf'));

$v = new Validator($trans, ['x' => $file], ['x' => 'mimetypes:text/*']);
$this->assertTrue($v->passes());
Expand All @@ -2082,18 +2098,37 @@ public function testValidateMime()
$trans = $this->getIlluminateArrayTranslator();
$uploadedFile = [__FILE__, '', null, null, null, true];

$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('php'));
$v = new Validator($trans, ['x' => $file], ['x' => 'mimes:php']);
$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('pdf'));
$file->expects($this->any())->method('getExtension')->will($this->returnValue('pdf'));
$v = new Validator($trans, ['x' => $file], ['x' => 'mimes:pdf']);
$this->assertTrue($v->passes());

$file2 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'isValid'])->setConstructorArgs($uploadedFile)->getMock();
$file2->expects($this->any())->method('guessExtension')->will($this->returnValue('php'));
$file2->expects($this->any())->method('guessExtension')->will($this->returnValue('pdf'));
$file2->expects($this->any())->method('isValid')->will($this->returnValue(false));
$v = new Validator($trans, ['x' => $file2], ['x' => 'mimes:php']);
$v = new Validator($trans, ['x' => $file2], ['x' => 'mimes:pdf']);
$this->assertFalse($v->passes());
}

public function testValidateMimeEnforcesPhpCheck()
{
$trans = $this->getIlluminateArrayTranslator();
$uploadedFile = [__FILE__, '', null, null, null, true];

$file = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file->expects($this->any())->method('guessExtension')->will($this->returnValue('pdf'));
$file->expects($this->any())->method('getExtension')->will($this->returnValue('php'));
$v = new Validator($trans, ['x' => $file], ['x' => 'mimes:pdf']);
$this->assertFalse($v->passes());

$file2 = $this->getMockBuilder('Symfony\Component\HttpFoundation\File\UploadedFile')->setMethods(['guessExtension', 'getExtension'])->setConstructorArgs($uploadedFile)->getMock();
$file2->expects($this->any())->method('guessExtension')->will($this->returnValue('php'));
$file2->expects($this->any())->method('getExtension')->will($this->returnValue('php'));
$v = new Validator($trans, ['x' => $file2], ['x' => 'mimes:pdf,php']);
$this->assertTrue($v->passes());
}

/**
* @requires extension fileinfo
*/
Expand Down