diff --git a/README.md b/README.md index f959087..d885eef 100644 --- a/README.md +++ b/README.md @@ -89,10 +89,10 @@ Don't forget to add `enctype="multipart/form-data"` in your form tag `
` if ### Namespacing -The class is now namespaced in the `Verot/Upload` namespace. If you have the error *Fatal error: Class 'Upload' not found*, then make sure your file belongs to the namespace, or instantiate the class with its fully qualified name: +The class is now namespaced in the `Verot/Upload` namespace. If you have the error *Fatal error: Class 'Upload' not found*, then `use` the class fully qualified name, or instantiate the class with its fully qualified name: ```php -namespace Verot\Upload; +use Verot\Upload\Upload; $handle = new Upload($_FILES['image_field']); ``` or @@ -168,6 +168,23 @@ echo $handle->process(); die(); ``` +### Warning about security + +By default, the class relies on MIME type detection to assess whether the file can be uploaded or not. Several MIME type detection methods are used, depending on the server configuration. The class relies on a blacklist of dangerous file extensions to prevent uploads (or to rename dangerous scripts as text files), as well as a whitelist of accepted MIME types. + +But it is not the purpose of this class to do in-depth checking and heuristics to attempt to detect maliciously crafted files. For instance, an attacker can craft a file that will have the correct MIME type, but will carry a malicious payload, such as a valid GIF file which would contain some code leading to a XSS vulnerability. If this GIF file has a .html extension, it may be uploaded (depending on the class's settings) and display an XSS vulnerability. + +However, you can mitigate this by restricting the kind of files that can be uploaded, using `allowed` and `forbidden`, to whitelist and blacklist files depending on their MIME type or extension. *The most secure option would be to only whitelist extensions that you want to allow through, and then making sure that your server always serves the file with the content-type based on the file extension.* + +For instance, if you only want to allow one type of file, you could whitelist only its file extension. In the following example, only .html files are let through, and are not converted to a text file: +```php +$handle->allowed = array('html'); +$handle->forbidden = array(); +$handle->no_script = false; +``` + +In the end, it is your responsibility to make sure the correct files are uploaded. But more importantly, it is your responsibility to serve the uploaded files correctly, for instance by forcing the server to always provide the content-type based on the file extension. + ### Troubleshooting diff --git a/src/class.upload.php b/src/class.upload.php index 524f19a..5a32c54 100755 --- a/src/class.upload.php +++ b/src/class.upload.php @@ -408,7 +408,7 @@ class Upload { * The list of blacklisted extensions is in {@link dangerous} * * Note that this check happens before checking for forbidden MIME types or extensions - * If you want to forbid uploads rather than turning scripts into text files, + * If you want to forbid uploads rather than turning scripts into text files, * set {@link no_script} to false and use {@link forbidden} instead * * @access public @@ -1892,13 +1892,15 @@ function init() { 'bat', 'phar', 'wsdl', + 'html', + 'htm', ); - + $this->forbidden = array_merge($this->dangerous, array( 'exe', 'dll', )); - + $this->allowed = array( 'application/arj', 'application/excel', @@ -2118,7 +2120,7 @@ function __construct($file, $lang = 'en_GB') { */ function upload($file, $lang = 'en_GB') { - $this->version = '09/12/2022'; + $this->version = '10/09/2024'; $this->file_src_name = ''; $this->file_src_name_body = ''; @@ -3151,7 +3153,7 @@ function process($server_path = null) { } // if the file is text based, or has a dangerous extension, we rename it as .txt if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false) && (substr($file_src_name, -4) != '.txt')) - || preg_match('/\.(' . implode('|', $this->dangerous) . ')$/i', $this->file_src_name) + || preg_match('/\.(' . implode('|', $this->dangerous) . ')/i', $this->file_src_name) || $this->file_force_extension && empty($file_src_name_ext)) { $this->file_src_mime = 'text/plain'; if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext; @@ -3173,7 +3175,7 @@ function process($server_path = null) { if (strpos($v, '/') == false) { if ($v == '*' || strtolower($v) == strtolower($file_src_name_ext)) { $allowed = true; - break; + break; } } else { list($v1, $v2) = explode('/', $v); @@ -3191,7 +3193,7 @@ function process($server_path = null) { if ($v == '*' || strtolower($v) == strtolower($file_src_name_ext)) { $allowed = false; $this->log .= '- extension ' . $v . ' is forbidden !
'; - break; + break; } } else { list($v1, $v2) = explode('/', $v); @@ -5239,5 +5241,3 @@ function imagebmp(&$im, $filename = "") { return true; } } - -?> diff --git a/src/lang/class.upload.ar_EG.php b/src/lang/class.upload.ar_EG.php index 3de578b..299a758 100644 --- a/src/lang/class.upload.ar_EG.php +++ b/src/lang/class.upload.ar_EG.php @@ -84,4 +84,3 @@ $translation['no_conversion_type'] = 'نوع التحويل غير معروف.'; $translation['copy_failed'] = 'خطأ في نسخ الملف على الخادم. copy() فشلت.'; $translation['reading_failed'] = 'خطأ في قراءة الملف.'; - diff --git a/src/lang/class.upload.tr_TR.php b/src/lang/class.upload.tr_TR.php index a27da0a..f042a09 100644 --- a/src/lang/class.upload.tr_TR.php +++ b/src/lang/class.upload.tr_TR.php @@ -1,4 +1,3 @@ -