Description:
------------
 The functions finfo_file() and mime_content_type() could be tricked into allowing PHP code execution if a space was placed after the short code <?.  So if my code (test.php) had a single space after the initial <? It would pass the vulnerable codes mime_content_type() check and return as text/html.  If the space was removed it would be flagged as text/x-php.  The vulnerable code checked the mime type using either mime_content_type() or finfo_file() to either allow or block the upload if the file was determined to be PHP or not.


Test script:
---------------
example.php
<?php
 $tmp_name = '/tmp/test.php';
 echo 'Current PHP version: ' . phpversion();
 $finfo = finfo_open(FILEINFO_MIME);
 echo "\nfinfo_file() results: ";
 $file_type = finfo_file($finfo, $tmp_name);
 finfo_close($finfo);
 echo "$file_type\n";
 $file_type = mime_content_type($tmp_name);
 echo "mime_content_type() results: ";
 echo "$file_type\n";
 $cat = `cat $tmp_name`;
 echo "\n";
 echo urlencode($cat);
 echo "\n";
?>

test.php
<?[singlespace]
echo "test";
?>

$ php example.php
Current PHP version: 7.0.22-0ubuntu0.16.04.1
finfo_file() results: text/plain; charset=us-ascii
mime_content_type() results: text/plain
%3C%3F+%0A%0A%3F%3E%0A

$ vi /tmp/test.php 
test.php
<?[space_removed]
echo "test";
?>
$ php example.php
Current PHP version: 7.0.22-0ubuntu0.16.04.1
finfo_file() results: text/x-php; charset=us-ascii
mime_content_type() results: text/x-php

%3C%3F%0A%0A%3F%3E%0A

Expected result:
----------------
Both types detected should be text/x-php.

Actual result:
--------------
With a space after <? it's text/plain vs no space is text/x-php and can be used to bypass security controls.