Skip to content

v6.5: feat(files): Derive file extension from content with security checks

Choose a tag to compare

@thorewi thorewi released this 02 Oct 07:44
· 9 commits to master since this release
Adds `Helpers::getNameByContents()` and `Helpers::detectExtension()` to provide accurate file extensions based on content, rather than relying on potentially incorrect caller-provided names. This is especially useful for file blobs from APIs or generators.

It integrates `symfony/mime` for robust type mapping and includes a critical security feature: any detected extension (even if valid by mime type) that matches a blocked extension (e.g., `php`) is rejected, falling back to a generic `.bin` extension. This prevents malicious files from being stored with executable suffixes.