Skip to content

Commit 6f12ebd

Browse files
pmPaulispmPaulis
committed
FOUR-19429
Adding test related to the API FOUR-19429: Adding changes in the test Adding labels in the en.json Adding svg in the accepted files
1 parent 3ea06e3 commit 6f12ebd

File tree

4 files changed

+596
-68
lines changed

4 files changed

+596
-68
lines changed

‎ProcessMaker/Http/Controllers/Api/ProcessRequestFileController.php‎

Lines changed: 30 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -457,9 +457,9 @@ private function validateFile(UploadedFile $file, &$errors)
457457
$this->validateFileExtension($file, $errors);
458458
}
459459

460-
// Validate MIME type if enabled
460+
// Validate MIME type vs extension if enabled
461461
if (config('files.enable_mime_validation', true)) {
462-
$this->validateMimeType($file, $errors);
462+
$this->validateExtensionMimeTypeMatch($file, $errors);
463463
}
464464

465465
// Validate specific file types (e.g., PDF for JavaScript content)
@@ -479,106 +479,68 @@ private function validateFile(UploadedFile $file, &$errors)
479479
*/
480480
private function rejectArchiveFiles(UploadedFile $file, &$errors)
481481
{
482-
$dangerousExtensions = [
483-
'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'lzma',
484-
'cab', 'ar', 'iso', 'dmg', 'pkg', 'deb', 'rpm',
485-
];
482+
$dangerousExtensions = config('files.dangerous_extensions');
486483

487484
$fileExtension = strtolower($file->getClientOriginalExtension());
488485

489486
if (in_array($fileExtension, $dangerousExtensions)) {
490-
$errors[] = __('File extension not allowed', [
491-
'extension' => $fileExtension,
492-
]);
487+
$errors['message'] = __('Uploaded file type is not allowed');
488+
489+
return;
493490
}
494491

495492
// Also check MIME types for archive files
496-
$dangerousMimeTypes = [
497-
'application/zip',
498-
'application/x-rar-compressed',
499-
'application/x-7z-compressed',
500-
'application/x-tar',
501-
'application/gzip',
502-
'application/x-bzip2',
503-
'application/x-xz',
504-
'application/x-lzma',
505-
'application/vnd.ms-cab-compressed',
506-
'application/x-iso9660-image',
507-
];
493+
$dangerousMimeTypes = config('files.dangerous_mime_types');
508494

509495
$fileMimeType = $file->getMimeType();
510496

511497
if (in_array($fileMimeType, $dangerousMimeTypes)) {
512-
$errors[] = __('Mime type not allowed', [
513-
'mime_type' => $fileMimeType,
514-
]);
498+
$errors['message'] = __('Uploaded mime file type is not allowed');
515499
}
516500
}
517501

518502
/**
519-
* Validate file extension against allowed extensions
503+
* Validate that file extension matches the MIME type
520504
*
521505
* @param UploadedFile $file
522506
* @param array $errors
523507
* @return void
524508
*/
525-
private function validateFileExtension(UploadedFile $file, &$errors)
509+
private function validateExtensionMimeTypeMatch(UploadedFile $file, &$errors)
526510
{
527-
$allowedExtensions = config('files.allowed_extensions', [
528-
'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
529-
'txt', 'csv', 'jpg', 'jpeg', 'png', 'gif', 'mp3', 'mp4',
530-
]);
531-
532511
$fileExtension = strtolower($file->getClientOriginalExtension());
512+
$fileMimeType = $file->getMimeType();
533513

534-
if (!in_array($fileExtension, $allowedExtensions)) {
535-
$errors[] = __('File extension not allowed', [
536-
'extension' => $fileExtension,
537-
'allowed' => implode(', ', $allowedExtensions),
538-
]);
514+
// Get extension to MIME type mapping from configuration
515+
$extensionMimeMap = config('files.extension_mime_map');
516+
517+
// Check if extension exists in our map
518+
if (!isset($extensionMimeMap[$fileExtension])) {
519+
$errors['message'] = __('File extension not allowed');
520+
521+
return;
522+
}
523+
524+
// Check if MIME type matches any of the expected types for this extension
525+
if (!in_array($fileMimeType, $extensionMimeMap[$fileExtension])) {
526+
$errors['message'] = __('The file extension does not match the actual file content');
539527
}
540528
}
541529

542530
/**
543-
* Validate MIME type against allowed MIME types
531+
* Validate file extension against allowed extensions
544532
*
545533
* @param UploadedFile $file
546534
* @param array $errors
547535
* @return void
548536
*/
549-
private function validateMimeType(UploadedFile $file, &$errors)
537+
private function validateFileExtension(UploadedFile $file, &$errors)
550538
{
551-
$allowedMimeTypes = config('files.allowed_mime_types', [
552-
// Documents
553-
'application/pdf',
554-
'application/msword',
555-
'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
556-
'application/vnd.ms-excel',
557-
'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
558-
'application/vnd.ms-powerpoint',
559-
'application/vnd.openxmlformats-officedocument.presentationml.presentation',
560-
'text/plain',
561-
'text/csv',
562-
563-
// Images
564-
'image/jpeg',
565-
'image/png',
566-
'image/gif',
567-
568-
// Audio
569-
'audio/mpeg',
570-
571-
// Video
572-
'video/mp4',
573-
]);
574-
575-
$fileMimeType = $file->getMimeType();
539+
$allowedExtensions = config('files.allowed_extensions');
540+
$fileExtension = strtolower($file->getClientOriginalExtension());
576541

577-
if (!in_array($fileMimeType, $allowedMimeTypes)) {
578-
$errors[] = __('Mime type not allowed', [
579-
'mime_type' => $fileMimeType,
580-
'allowed' => implode(', ', $allowedMimeTypes),
581-
]);
542+
if (!in_array($fileExtension, $allowedExtensions)) {
543+
$errors['message'] = __('File extension not allowed');
582544
}
583545
}
584546

‎config/files.php‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
<?php
2+
3+
return [
4+
/*
5+
|--------------------------------------------------------------------------
6+
| File Upload Configuration
7+
|--------------------------------------------------------------------------
8+
|
9+
| This file contains configuration options for file uploads including
10+
| allowed file extensions and MIME types for security validation.
11+
|
12+
*/
13+
14+
/*
15+
|--------------------------------------------------------------------------
16+
| Allowed File Extensions
17+
|--------------------------------------------------------------------------
18+
|
19+
| List of file extensions that are allowed to be uploaded.
20+
| Only files with these extensions will be accepted.
21+
| Archive formats (.zip, .rar, .tar, .7z) are explicitly NOT allowed for security.
22+
|
23+
*/
24+
'allowed_extensions' => [
25+
// Documents
26+
'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
27+
'txt', 'csv',
28+
29+
// Images
30+
'jpg', 'jpeg', 'png', 'gif', 'svg',
31+
32+
// Audio
33+
'mp3',
34+
35+
// Video
36+
'mp4',
37+
],
38+
/*
39+
|--------------------------------------------------------------------------
40+
| Extension to MIME Type Mapping
41+
|--------------------------------------------------------------------------
42+
|
43+
| An associative array that maps each allowed file extension to one or more
44+
| corresponding MIME types. This provides a strong validation to ensure that
45+
| a file's content type (MIME type) matches its declared extension,
46+
| preventing malicious files (like a script disguised as an image) from being uploaded.
47+
|
48+
*/
49+
'extension_mime_map' => [
50+
// Documents
51+
'pdf' => ['application/pdf'],
52+
'doc' => ['application/msword'],
53+
'docx' => ['application/vnd.openxmlformats-officedocument.wordprocessingml.document'],
54+
'xls' => ['application/vnd.ms-excel'],
55+
'xlsx' => ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
56+
'ppt' => ['application/vnd.ms-powerpoint'],
57+
'pptx' => ['application/vnd.openxmlformats-officedocument.presentationml.presentation'],
58+
'txt' => ['text/plain'],
59+
'csv' => ['text/csv', 'application/csv'],
60+
61+
// Audio
62+
'jpg' => ['image/jpeg'],
63+
'jpeg' => ['image/jpeg'],
64+
'png' => ['image/png'],
65+
'gif' => ['image/gif'],
66+
'svg' => ['image/svg+xml'],
67+
68+
// Audio
69+
'mp3' => ['audio/mpeg'],
70+
71+
// Video
72+
'mp4' => ['video/mp4'],
73+
],
74+
75+
/*
76+
|--------------------------------------------------------------------------
77+
| Enable MIME Type Validation
78+
|--------------------------------------------------------------------------
79+
|
80+
| Whether to enable MIME type validation against allowed_mime_types list
81+
| AND validate that MIME type corresponds to file extension using extension_mime_map.
82+
| This provides comprehensive validation to prevent malicious files.
83+
| Recommended to keep this enabled for security.
84+
|
85+
*/
86+
'enable_mime_validation' => env('ENABLE_MIME_VALIDATION', true),
87+
88+
/*
89+
|--------------------------------------------------------------------------
90+
| Enable Extension Validation
91+
|--------------------------------------------------------------------------
92+
|
93+
| Whether to enable basic file extension validation against allowed_extensions list.
94+
| This validates that the file extension is in the allowed list.
95+
| Recommended to keep this enabled for security.
96+
|
97+
*/
98+
'enable_extension_validation' => env('ENABLE_EXTENSION_VALIDATION', true),
99+
100+
/*
101+
|--------------------------------------------------------------------------
102+
| Security Dangerous File Extensions
103+
|--------------------------------------------------------------------------
104+
|
105+
| Archive formats (.zip, .rar, .tar, .7z, .gz, etc.) are explicitly
106+
| NOT allowed for security reasons. These file types can contain
107+
| malicious content and are blocked by default.
108+
|
109+
*/
110+
'dangerous_extensions' => [
111+
'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'lzma',
112+
'cab', 'ar', 'iso', 'dmg', 'pkg', 'deb', 'rpm',
113+
],
114+
115+
/*
116+
|--------------------------------------------------------------------------
117+
| Security Dangerous MIME Types
118+
|--------------------------------------------------------------------------
119+
|
120+
| A list of MIME types associated with archives and executables.
121+
| This provides an additional layer of security to prevent the upload of
122+
| compressed files or other potentially dangerous content, even if their
123+
| file extension has been tampered with.
124+
|
125+
*/
126+
'dangerous_mime_types' => [
127+
'application/zip',
128+
'application/x-rar-compressed',
129+
'application/x-7z-compressed',
130+
'application/x-tar',
131+
'application/gzip',
132+
'application/x-bzip2',
133+
'application/x-xz',
134+
'application/x-lzma',
135+
'application/vnd.ms-cab-compressed',
136+
'application/x-iso9660-image',
137+
],
138+
];

‎resources/lang/en.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -944,6 +944,7 @@
944944
"File Access": "File Access",
945945
"File crt": "File crt",
946946
"File Download": "File Download",
947+
"File extension not allowed": "File extension not allowed",
947948
"File ID does not exist": "File ID does not exist",
948949
"File key": "File key",
949950
"File Manager": "File Manager",
@@ -2198,6 +2199,7 @@
21982199
"The field unter validation must be after or equal to the given field.": "The field unter validation must be after or equal to the given field.",
21992200
"The field unter validation must be before or equal to the given field.": "The field unter validation must be before or equal to the given field.",
22002201
"The field unter validation must be before the given date.": "The field unter validation must be before the given date.",
2202+
"The file extension does not match the actual file content": "The file extension does not match the actual file content",
22012203
"The file is processing. You may continue working while the log file compiles.": "The file is processing. You may continue working while the log file compiles.",
22022204
"The file you are importing was made with an older version of ProcessMaker. Advanced import is not available. All assets will be copied.": "The file you are importing was made with an older version of ProcessMaker. Advanced import is not available. All assets will be copied.",
22032205
"The following items should be configured to ensure your process is functional.": "The following items should be configured to ensure your process is functional.",
@@ -2443,6 +2445,8 @@
24432445
"Upload": "Upload",
24442446
"Uploaded By": "Uploaded By",
24452447
"Uploaded": "Uploaded",
2448+
"Uploaded file type is not allowed.": "Uploaded file type is not allowed.",
2449+
"Uploaded mime file type is not allowed": "Uploaded mime file type is not allowed",
24462450
"Uploading...": "Uploading...",
24472451
"Uppercase characters": "Uppercase characters",
24482452
"URI": "URI",

0 commit comments

Comments
 (0)