josantonius / php-mime-type Goto Github PK

With this library you are getting the mime type based on the file extension and not the actual mime type of the file, based on the file content (the actual binary data), which is s HUGE security problem. If someone uses this with form submitted files, they are introducing a massive security hole in their code as the extension of the file can be easily changed by anyone so that they can easily upload a file.

You must place a warning in your readme so that this is not used for form upload purposes or for public facing projects.

Have a look at how PHP does this with the function mime_content_type and look for actual code and you will see that it actually opens the file to read the first bytes.

I realize that you specify that this library determines the mime type from an extension, but you need to warn people about the dangers of that in case someone less experienced uses this for production ready projects where security is very important.

Hope this helps and does not get deleted.

Thanks you for this library ;) You did a great job.

Hope i will be able to help in any kind of maner.

Hello,

It's fix on the last commit.

Have a nice day !

".woff2": "application/x-font-woff2",

It's a common missing since woff2 is quite recent.

Hello,

Since there is millions of systems which are PHP 5 only (at least until the end of 2017 - because of native PHP support from Debian 8 - the latest stable released of Debian - which run now, PHP 5.6.29).

I advice you to make your library PHP 5.6 compliant, by using with awesome one :

if (version_compare(PHP_VERSION, '7.0.0') >= 0) {
// PHP7 only stuff
}

Then, there is some rewriting to do :

• declare(strict_types=1); (PHP 7 only)
• remove : :type from static functions (PHP 7 only) - i advice you to completely remove this if you won't deal with 2 classes
• inside getMimeFromExtension, change for : return (isset(static::$mimeTypes[$ext]) ? static::$mimeTypes[$ext] : "undefined"); (?? is PHP 7 only)

I'm currently rewriting all your functions to make it works under PHP 5.6. I will be maybe fork it on Github if i got times.