fix(security): file extension should not contain special characters

Author: streamtw

src/Exceptions/InvalidExtensionException.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace UniSharp\LaravelFilemanager\Exceptions;
+
+class InvalidExtensionException extends \Exception
+{
+    public function __construct()
+    {
+        $this->message = 'File extension is not valid.';
+    }
+}

src/LfmUploadValidator.php

@@ -9,6 +9,7 @@
 use UniSharp\LaravelFilemanager\Exceptions\FileFailedToUploadException;
 use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedConfigurationMaximumException;
 use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedIniMaximumException;
+use UniSharp\LaravelFilemanager\Exceptions\InvalidExtensionException;
 use UniSharp\LaravelFilemanager\Exceptions\InvalidMimeTypeException;
 use UniSharp\LaravelFilemanager\LfmPath;
 
@@ -94,6 +95,17 @@ public function mimeTypeIsValid($available_mime_types)
         return $this;
     }
 
+    public function extensionIsValid()
+    {
+        $extension = strtolower($this->file->getClientOriginalExtension());
+
+        if (preg_match('/[^a-zA-Z0-9]/', $extension) > 0) {
+            throw new InvalidExtensionException();
+        }
+
+        return $this;
+    }
+
     public function sizeIsLowerThanConfiguredMaximum($max_size_in_kb)
     {
         // size to kb unit is needed

tests/LfmUploadValidatorTest.php

@@ -9,6 +9,7 @@
 use UniSharp\LaravelFilemanager\Exceptions\FileFailedToUploadException;
 use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedConfigurationMaximumException;
 use UniSharp\LaravelFilemanager\Exceptions\FileSizeExceedIniMaximumException;
+use UniSharp\LaravelFilemanager\Exceptions\InvalidExtensionException;
 use UniSharp\LaravelFilemanager\Exceptions\InvalidMimeTypeException;
 use UniSharp\LaravelFilemanager\LfmPath;
 use UniSharp\LaravelFilemanager\LfmUploadValidator;
@@ -167,6 +168,18 @@ public function testFailsExtensionIsNotExcutableWithExtensionNotLowerCase()
         $validator->extensionIsNotExcutable(['php', 'html']);
     }
 
+    public function testFailsExtensionIsValidWithSpecialCharacters()
+    {
+        $uploaded_file = m::mock(UploadedFile::class);
+        $uploaded_file->shouldReceive('getClientOriginalExtension')->andReturn('html@');
+
+        $validator = new LfmUploadValidator($uploaded_file);
+
+        $this->expectException(InvalidExtensionException::class);
+
+        $validator->extensionIsValid();
+    }
+
     public function testPassesSizeIsLowerThanConfiguredMaximum()
     {
         $uploaded_file = m::mock(UploadedFile::class);