[wp-trac] [WordPress Trac] #50136: Files types not included in Upload file types are allowed to be uploaded because of loose file extension check

[WordPress Trac]

#50136: Files types not included in Upload file types are allowed to be uploaded
because of loose file extension check
--------------------------+------------------------------
 Reporter:  Nikschavan    |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Upload        |     Version:
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  multisite
--------------------------+------------------------------

Comment (by ayeshrajans):

 @Nikschavan - you are absolutely right, my bad, the extension list was
 allowed with a simple text match, and I believe that's a big oopsie. For
 example, leaving extensions like `h` might allow `html` extension.



 >>!preg_match('/\b' . preg_quote($ext, '/') . '\b/i') would be a better
 check.

 > One thing to note is - There are also file extension groups, eg
 onetoc|onetoc2|onetmp|onepkg from which anyone extension can be matched.

 The `\b` should take care of it. For example the regex above will not
 match `ach|html|tht` when `h` is allowed as an extension. But it will
 allow mime type key `txt|h|flw` for `h` key.

 I will work on a patch now.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/50136#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform