Skip to content
Permalink
Browse files

Mark @ file syntax as deprecated.

The @ is not a completely safe way to send files. If a developer passes
along user data, that user data can include arbitrary files. This is not
desirable, and can go really wrong with URLs.

This also improves content-type and filename detection for local stream
resources.

Refs #6540
  • Loading branch information...
markstory committed May 13, 2015
1 parent c7c32b6 commit 9ab2b4dbf4bb3b0784e5daa6181bc49f614ee2af
Showing with 19 additions and 3 deletions.
  1. +11 −0 src/Network/Http/FormData.php
  2. +8 −3 tests/TestCase/Network/Http/FormDataTest.php
@@ -87,6 +87,11 @@ public function add($name, $value)
} elseif (is_resource($value)) {
$this->_parts[] = $this->addFile($name, $value);
} elseif (is_string($value) && strlen($value) && $value[0] === '@') {
trigger_error(
'Using the @ syntax for file uploads is not safe and is deprecated. ' .
'Instead you should use file handles.',
E_USER_DEPRECATED
);
$this->_parts[] = $this->addFile($name, $value);
} else {
$this->_parts[] = $this->newPart($name, $value);
@@ -124,6 +129,12 @@ public function addFile($name, $value)
$contentType = 'application/octet-stream';
if (is_resource($value)) {
$content = stream_get_contents($value);
if (stream_is_local($value)) {
$finfo = new \finfo(FILEINFO_MIME);
$metadata = stream_get_meta_data($value);
$contentType = $finfo->file($metadata['uri']);
$filename = basename($metadata['uri']);
}
} else {
$finfo = new \finfo(FILEINFO_MIME);
$value = substr($value, 1);
@@ -137,6 +137,9 @@ public function testAddArray()
*/
public function testAddArrayWithFile()
{
$errorLevel = error_reporting();
error_reporting($errorLevel & ~E_USER_DEPRECATED);
$file = CORE_PATH . 'VERSION.txt';
$contents = file_get_contents($file);
@@ -163,6 +166,8 @@ public function testAddArrayWithFile()
'',
];
$this->assertEquals(implode("\r\n", $expected), $result);
error_reporting($errorLevel);
}
/**
@@ -176,7 +181,7 @@ public function testAddFile()
$contents = file_get_contents($file);
$data = new FormData();
$data->add('upload', '@' . $file);
$data->add('upload', fopen($file, 'r'));
$boundary = $data->boundary();
$result = (string)$data;
@@ -213,8 +218,8 @@ public function testAddFileHandle()
$expected = [
'--' . $boundary,
'Content-Disposition: form-data; name="upload"',
'Content-Type: application/octet-stream',
'Content-Disposition: form-data; name="upload"; filename="VERSION.txt"',
'Content-Type: text/plain; charset=us-ascii',
'',
$contents,
'--' . $boundary . '--',

0 comments on commit 9ab2b4d

Please sign in to comment.
You can’t perform that action at this time.