v1.3.5

What's Changed

• Fix false positives on legit image uploads by @arnoudhgz in #19

New Contributors

• @arnoudhgz made their first contribution in #19

Full Changelog: v1.3.4...v1.3.5

v1.3.4

Fix #12 (follow-up): the v1.3.3 fix split the PHP payload string via concatenation but the explanatory comment still quoted the literal webshell signature verbatim, which Sansec eComscan's eval_post_91ce4 rule pattern-matches without context. The comment has been rewritten to describe the rationale without reproducing the signature.

v1.3.3

Fix #12: avoid eComscan false positive by obfuscating attack-simulation payloads in test fixtures.

v1.3.2

Release 1.3.2

1.3.1

What's Changed

• Add .inc, .module, .phps to blocked extension patterns and BASE_BLOCKED_EXTENSIONS hash map
• Closes double-extension bypass where files like file.inc.png or file.module.gif passed BLOCKED_EXTENSION_PATTERN
• These extensions are server-executable in common web server configurations (Apache, PHP-FPM)
• Updated admin panel blocked extensions display, README, and copilot instructions

Fixes #4

v1.3.0

What's New

Configurable Allowed & Blocked Extensions (#3)

File upload extension policies are now configurable via the Magento admin panel at Stores > Configuration > PolyShell Protection without requiring code changes.

• Additional Allowed Extensions — comma-separated list of extra extensions to permit (e.g. ai, psd, svg).
• Additional Blocked Extensions — comma-separated list of extra extensions to block (e.g. svg, swf, html). The blocklist always overrides all allowlists.
• Base code-defined allowlist and blocklist are displayed as read-only notes in the admin UI.
• rar added to the base allowed extensions.

Plugin Behavior Changes

• ValidateUploadedFileNamePlugin and ValidateCustomOptionUploadPlugin now validate filenames against the merged allowlist/blocklist via FileUploadGuard::assertSafeFileName() instead of unconditionally blocking all custom option file uploads. Safe files pass through; dangerous files are blocked with a logged warning.

New Files

• etc/acl.xml — ACL resource for admin config access.
• etc/config.xml — Default configuration values.
• etc/adminhtml/system.xml — Admin UI for extension configuration.

Internal

• FileUploadGuard now depends on ScopeConfigInterface for reading admin-configured extensions.
• ALLOWED_EXTENSIONS renamed to BASE_ALLOWED_EXTENSIONS (public).
• New BASE_BLOCKED_EXTENSIONS constant and getAllowedExtensions() / getBlockedExtensions() methods.
• Updated README and copilot-instructions with admin configuration documentation.

1.2.1

Fix

• Support Magento Open Source (Community Edition) — skip test for Adobe Commerce-only class AbstractUploadFile when not present (#2)
• Add Magento composer repository to composer.json for dependency resolution