Page MenuHomePhabricator

files of mimetype with unknown file extension are automatically allowed
Open, LowPublic

Description

UploadBase::verifyExtension: no file extension known for mime type image/x-ms-bmp, passing file

This seems like a strange default. Would properly be better to generate a warning in that case or simply error out.

(To reproduce: upload a x-ms-bmp file. this mimetype is currently not in the includes/mime.types. now upload it over another type of file. make sure "ignore warnings" is not checked.)


Version: unspecified
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=39012

Details

Reference
bz22934

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 11:00 PM
bzimport set Reference to bz22934.
bzimport added a subscriber: Unknown Object (MLST).

Bryan.TongMinh wrote:

Cc Robla, he has done some research on the extension verification if I recall correctly.

The problem here is with verifyExtension() in includes/upload/UploadBase.php
Basically it allows you to upload unknown file types in certain situations.

When the mime type of the new file is unknown, and when the existing file is not on the list of "recognizable filteypes". ("passing file with unknown detected mime type; unrecognized extension '$extension', can't verify\n")

The second case is when we don't know the extension of a mimetype that we do know. ( " no file extension known for mime type $mime, passing file\n")

I don't see a good reason for these exceptions. Why do we have them ? Especially the latter is clearly problematic as the x-ms-bmp issue has shown. It creates trouble if our list of mime information or fileextensions isn't complete.