Changeset 40124

Timestamp:

02/25/2017 04:07:25 PM (8 years ago)

Author:

joemcgill

Message:

Media: Reduce failing uploads following 4.7.1.

[39831] introduced more strict MIME type checking for uploads, which
resulted in unintetionally blocking several filetypes that were
previously valid. This change uses a more targeted approach to MIME
validation to restore previous behavior for most types.

Props blobfolio, iandunn, ipstenu, markoheijnen, xknown, joemcgill.
Fixes #39550, #39552.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (3 diffs)
• tests/phpunit/data/uploads (added)
• tests/phpunit/data/uploads/dashicons.woff (added)
• tests/phpunit/data/uploads/pages-to-word.docx (added)
• tests/phpunit/data/uploads/video-play.svg (added)
• tests/phpunit/tests/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -2270 +2270 @@
     }
 
+    $real_mime = false;
+
     // Validate image types.
     if ( $type && 0 === strpos( $type, 'image/' ) ) {
@@ -2276 +2278 @@
         $real_mime = wp_get_image_mime( $file );
 
-        if ( ! $real_mime ) {
-            $type = $ext = false;
-        } elseif ( $real_mime != $type ) {
+        if ( $real_mime && $real_mime != $type ) {
             /**
              * Filters the list mapping image mime types to their respective extensions.
@@ -2309 +2309 @@
                 $type = $wp_filetype['type'];
             } else {
-                $type = $ext = false;
+                // Reset $real_mime and try validating again.
+                $real_mime = false;
             }
         }
-    } elseif ( function_exists( 'finfo_file' ) ) {
-        // Use finfo_file if available to validate non-image files.
+    }
+
+    // Validate files that didn't get validated during previous checks.
+    if ( $type && ! $real_mime && extension_loaded( 'fileinfo' ) ) {
         $finfo = finfo_open( FILEINFO_MIME_TYPE );
         $real_mime = finfo_file( $finfo, $file );
         finfo_close( $finfo );
 
-        // If the extension does not match the file's real type, return false.
-        if ( $real_mime !== $type ) {
-            $type = $ext = false;
+        /*
+         * If $real_mime doesn't match what we're expecting, we need to do some extra
+         * vetting of application mime types to make sure this type of file is allowed.
+         * Other mime types are assumed to be safe, but should be considered unverified.
+         */
+        if ( $real_mime && ( $real_mime !== $type ) && ( 0 === strpos( $real_mime, 'application' ) ) ) {
+            $allowed = get_allowed_mime_types();
+
+            if ( ! in_array( $real_mime, $allowed ) ) {
+                $type = $ext = false;
+            }
         }
     }

trunk/tests/phpunit/tests/functions.php

@@ -915 +915 @@
         $this->assertEquals( $uuids, $unique_uuids );
     }
+
+    /**
+     * @ticket 39550
+     * @dataProvider _wp_check_filetype_and_ext_data
+     */
+    function test_wp_check_filetype_and_ext( $file, $filename, $expected ) {
+        if ( ! extension_loaded( 'fileinfo' ) ) {
+            $this->markTestSkipped( 'The fileinfo PHP extension is not loaded.' );
+        }
+
+        $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) );
+    }
+
+    /**
+     * @ticket 39550
+     */
+    function test_wp_check_filetype_and_ext_with_filtered_svg() {
+        $file = DIR_TESTDATA . '/uploads/video-play.svg';
+        $filename = 'video-play.svg';
+
+        $expected = array(
+            'ext' => 'svg',
+            'type' => 'image/svg+xml',
+            'proper_filename' => false,
+        );
+
+        add_filter( 'upload_mimes', array( $this, '_filter_mime_types_svg' ) );
+        $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) );
+
+        // Cleanup.
+        remove_filter( 'upload_mimes', array( $this, '_test_add_mime_types_svg' ) );
+    }
+
+    /**
+     * @ticket 39550
+     */
+    function test_wp_check_filetype_and_ext_with_filtered_woff() {
+        $file = DIR_TESTDATA . '/uploads/dashicons.woff';
+        $filename = 'dashicons.woff';
+
+        $expected = array(
+            'ext' => 'woff',
+            'type' => 'application/font-woff',
+            'proper_filename' => false,
+        );
+
+        add_filter( 'upload_mimes', array( $this, '_filter_mime_types_woff' ) );
+        $this->assertEquals( $expected, wp_check_filetype_and_ext( $file, $filename ) );
+
+        // Cleanup.
+        remove_filter( 'upload_mimes', array( $this, '_test_add_mime_types_woff' ) );
+    }
+
+    public function _filter_mime_types_svg( $mimes ) {
+        $mimes['svg'] = 'image/svg+xml';
+        return $mimes;
+    }
+
+    public function _filter_mime_types_woff( $mimes ) {
+        $mimes['woff'] = 'application/font-woff';
+        return $mimes;
+    }
+
+    public function _wp_check_filetype_and_ext_data() {
+        return array(
+            // Standard image.
+            array(
+                DIR_TESTDATA . '/images/canola.jpg',
+                'canola.jpg',
+                array(
+                    'ext' => 'jpg',
+                    'type' => 'image/jpeg',
+                    'proper_filename' => false,
+                ),
+            ),
+            // Image with wrong extension.
+            array(
+                DIR_TESTDATA . '/images/test-image-mime-jpg.png',
+                'test-image-mime-jpg.png',
+                array(
+                    'ext' => 'jpg',
+                    'type' => 'image/jpeg',
+                    'proper_filename' => 'test-image-mime-jpg.jpg',
+                ),
+            ),
+            // Image without extension.
+            array(
+                DIR_TESTDATA . '/images/test-image-no-extension',
+                'test-image-no-extension',
+                array(
+                    'ext' => false,
+                    'type' => false,
+                    'proper_filename' => false,
+                ),
+            ),
+            // Valid non-image file with an image extension.
+            array(
+                DIR_TESTDATA . '/formatting/big5.txt',
+                'big5.jpg',
+                array(
+                    'ext' => 'jpg',
+                    'type' => 'image/jpeg',
+                    'proper_filename' => false,
+                ),
+            ),
+            // Standard non-image file.
+            array(
+                DIR_TESTDATA . '/formatting/big5.txt',
+                'big5.txt',
+                array(
+                    'ext' => 'txt',
+                    'type' => 'text/plain',
+                    'proper_filename' => false,
+                ),
+            ),
+            // Non-image file with wrong sub-type.
+            array(
+                DIR_TESTDATA . '/uploads/pages-to-word.docx',
+                'pages-to-word.docx',
+                array(
+                    'ext' => 'docx',
+                    'type' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+                    'proper_filename' => false,
+                ),
+            ),
+            // Non-image file not allowed.
+            array(
+                DIR_TESTDATA . '/export/crazy-cdata.xml',
+                'crazy-cdata.xml',
+                array(
+                    'ext' => false,
+                    'type' => false,
+                    'proper_filename' => false,
+                ),
+            ),
+        );
+    }
 }