php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78023 PHP File MIME content Type
Submitted: 2019-05-17 07:50 UTC Modified: 2019-05-17 07:54 UTC
From: mertwal2 at gmail dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 7.1.29 OS: windows
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mertwal2 at gmail dot com
New email:
PHP Version: OS:

 

 [2019-05-17 07:50 UTC] mertwal2 at gmail dot com
Description:
------------
---
From manual page: https://php.net/function.mime-content-type
---
I am trying to upload files which has php code inserted in files. according to mime type checking through the mime type for php files but still its through the mime type for image here is the example of image in base64 value


<?php echo "hello world"?>
PK

here is the starting of image base64 value the code was blocked this image 

but not this type of content image.
PK
<?php echo "hello world"?>

i have upload the image that contains the particular code

Test script:
---------------
<?php 
  $_FILES['file']['name'];
  $var = mime_content_type($_FILES);
echo $var;
?>

Expected result:
----------------
error result on invalid mime types

Actual result:
--------------
success result on invalid mime type

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-05-17 07:54 UTC] requinix@php.net
-Status: Open +Status: Not a bug
 [2019-05-17 07:54 UTC] requinix@php.net
Best I can tell you're saying that the first one reports to be a PHP file while the second reports to be an image (or maybe zip)?

That's correct. MIME type checking works by looking at the first few bytes of a file to make a *best guess* as to the contents. It is not perfect, and it won't work well for things like PHP files that can embed their code at any point in the content. You must do additional checking and/or sanitization yourself.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 18:01:28 2024 UTC