Make WordPress Core

Opened 95 minutes ago

Last modified 85 minutes ago

#66419 new defect (bug)

Font Library: TTF uploads are rejected when fileinfo reports font/ttf

Reported by: dhrupo Owned by:
Priority: normal Milestone: Awaiting Review
Component: Upload Version: trunk
Severity: normal Keywords: has-patch has-unit-tests
Cc: Focuses:

Description

WP_Font_Utils::get_allowed_font_mime_types() expects TrueType fonts to be detected as font/sfnt. libmagic reports them as font/ttf since file 5.47 (​https://github.com/file/file/commit/6481672a8e), so wp_check_filetype_and_ext() rejects the upload with rest_font_upload_invalid_file_type.

This affects PHP builds that use a newer libmagic: PHP 8.6 bundles libmagic 5.48, and distribution builds that link the system libmagic can be affected on older PHP versions too.

Results for tests/phpunit/data/fonts/OpenSans-Regular.ttf:

detector result
PHP 8.5.12 finfo (bundled libmagic 5.46) font/sfnt
upstream libmagic master (with the fix below) font/ttf
PHP 8.6.0-dev finfo (bundled libmagic 5.48) application/octet-stream

The application/octet-stream result on PHP 8.6 is an upstream libmagic regression, fixed in ​https://github.com/file/file/commit/ba72caa54b and reported to PHP in ​https://github.com/php/php-src/issues/25051. Once PHP takes that fix, TTF files are detected as font/ttf, and the upload is still rejected.

Tests_REST_WpRestFontFacesController::test_create_item_with_multiple_font_files fails on PHP 8.6.0-dev and passes on PHP 8.5.

Suggested fix: during font uploads, accept a .ttf file detected as either font/sfnt or font/ttf. A PHP version check alone would miss builds that use the system libmagic.

Change History (2)

This ticket was mentioned in ​PR #15204 on ​WordPress/wordpress-develop by ​@dhrupo.


86 minutes ago
#1

  • Keywords has-patch has-unit-tests added

libmagic detects TrueType fonts as font/ttf since file 5.47, while WP_Font_Utils::get_allowed_font_mime_types() expects font/sfnt, so TTF uploads to the Font Library are rejected with rest_font_upload_invalid_file_type. PHP 8.6 bundles libmagic 5.48, and builds that link the system libmagic can use a newer one on older PHP versions.

This adds WP_Font_Utils::allow_ttf_mime_types() on wp_check_filetype_and_ext during font uploads only, next to the existing upload_mimes filter. It accepts a .ttf file detected as either font/sfnt or font/ttf. application/octet-stream and other extensions stay rejected.

Testing

  • New tests in Tests_Fonts_WpFontUtils_AllowTtfMimeTypes (--group 66419): fail on trunk (method missing), OK (7 tests, 9 assertions) on PHP 7.4.33, 8.5.12 and 8.6.0-dev.
  • --group font-library: OK (204 tests, 919 assertions) on PHP 7.4.33 and 8.5.12.
  • On PHP 8.6.0-dev, test_create_item_with_multiple_font_files still fails: that build reports TTF as application/octet-stream because of an upstream libmagic regression (fixed in file/file@ba72caa54b, reported in php/php-src#25051). With the upstream fix the result is font/ttf, which this change accepts.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Finding the issue by running the test suite on PHP 8.6, writing the change and tests, and running the checks above. I reviewed every line and checked the results myself.

#2 @dhrupo
85 minutes ago

PR: ​https://github.com/WordPress/wordpress-develop/pull/15204

With the PR, a .ttf upload detected as font/sfnt or font/ttf is accepted during font uploads; application/octet-stream and other extensions stay rejected. New tests pass on PHP 7.4, 8.5 and 8.6, and --group font-library passes on 7.4 and 8.5. test_create_item_with_multiple_font_files will pass on PHP 8.6 once PHP takes the libmagic fix from ​https://github.com/php/php-src/issues/25051.

Use of AI tools: I used Claude Code (Claude Opus 5.5) to find this by running the test suite on PHP 8.6 and to write the change and tests. I reviewed every line and checked the results myself.

Note: See TracTickets for help on using tickets.