php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78023 PHP File MIME content Type
Submitted: 2019-05-17 07:50 UTC Modified: 2019-05-17 07:54 UTC
From: mertwal2 at gmail dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 7.1.29 OS: windows
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mertwal2 at gmail dot com
New email:
PHP Version: OS:

 

 [2019-05-17 07:50 UTC] mertwal2 at gmail dot com
Description:
------------
---
From manual page: https://php.net/function.mime-content-type
---
I am trying to upload files which has php code inserted in files. according to mime type checking through the mime type for php files but still its through the mime type for image here is the example of image in base64 value


<?php echo "hello world"?>
PK

here is the starting of image base64 value the code was blocked this image 

but not this type of content image.
PK
<?php echo "hello world"?>

i have upload the image that contains the particular code

Test script:
---------------
<?php 
  $_FILES['file']['name'];
  $var = mime_content_type($_FILES);
echo $var;
?>

Expected result:
----------------
error result on invalid mime types

Actual result:
--------------
success result on invalid mime type

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-05-17 07:54 UTC] requinix@php.net
-Status: Open +Status: Not a bug
 [2019-05-17 07:54 UTC] requinix@php.net
Best I can tell you're saying that the first one reports to be a PHP file while the second reports to be an image (or maybe zip)?

That's correct. MIME type checking works by looking at the first few bytes of a file to make a *best guess* as to the contents. It is not perfect, and it won't work well for things like PHP files that can embed their code at any point in the content. You must do additional checking and/or sanitization yourself.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 23 08:01:30 2024 UTC