[wp-trac] [WordPress Trac] #50136: Files types not included in Upload file types are allowed to be uploaded because of loose file extension check

[WordPress Trac]

#50136: Files types not included in Upload file types are allowed to be uploaded
because of loose file extension check
--------------------------+------------------------------
 Reporter:  Nikschavan    |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Upload        |     Version:
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  multisite
--------------------------+------------------------------

Comment (by ayeshrajans):

 Hi @Nikschavan - isn't this a case of overly strict file type check?
 Looking at the line you have linked:

 `strpos( $ext_pattern, $ext ) !== false` <- This should block `tx` and
 `tx*` file extensions if `tx` in in the allow-list. Not the other way
 around that `txt` is allowed when `tx` is in the allow-list.

 However, I think we probably should improve the `strpos` call to allow
 case sensitivity and check with proper word boundaries to make the
 comparison more strict.

 `!preg_match('/\b' . preg_quote($ext, '/') . '\b/i')` would be a better
 check.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/50136#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform