Completed
Push — master ( a13fc6...7ee90b )
by Philip
02:42
created

MimeTypes::getMimeType()   A

Complexity

Conditions 2
Paths 2

Size

Total Lines 6
Code Lines 4

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
c 0
b 0
f 0
dl 0
loc 6
rs 9.4285
cc 2
eloc 4
nc 2
nop 1
1
<?php
2
3
/*
4
 * This file is part of the CRUDlex package.
5
 *
6
 * (c) Philip Lehmann-Böhm <[email protected]>
7
 *
8
 * For the full copyright and license information, please view the LICENSE
9
 * file that was distributed with this source code.
10
 */
11
12
namespace CRUDlex;
13
14
/**
15
 * Class to get a mimetype from a file.
16
 */
17
class MimeTypes {
18
19
    /**
20
     * Gets the mime type by just looking at the extension.
21
     *
22
     * @param string $file
23
     * the file to get the mimetype from
24
     *
25
     * @return mixed|string
0 ignored issues
show
Documentation introduced by
Consider making the return type a bit more specific; maybe use string.

This check looks for the generic type array as a return type and suggests a more specific type. This type is inferred from the actual code.

Loading history...
26
     * the mimetype
27
     */
28
    public function getMimeTypeByExtension($file) {
29
        // THX to
30
        // http://stackoverflow.com/questions/134833/how-do-i-find-the-mime-type-of-a-file-with-php
31
        // MIME types array
32
        $mimeTypes = [
33
            '323'       => 'text/h323',
34
            'acx'       => 'application/internet-property-stream',
35
            'ai'        => 'application/postscript',
36
            'aif'       => 'audio/x-aiff',
37
            'aifc'      => 'audio/x-aiff',
38
            'aiff'      => 'audio/x-aiff',
39
            'asf'       => 'video/x-ms-asf',
40
            'asr'       => 'video/x-ms-asf',
41
            'asx'       => 'video/x-ms-asf',
42
            'au'        => 'audio/basic',
43
            'avi'       => 'video/x-msvideo',
44
            'axs'       => 'application/olescript',
45
            'bas'       => 'text/plain',
46
            'bcpio'     => 'application/x-bcpio',
47
            'bin'       => 'application/octet-stream',
48
            'bmp'       => 'image/bmp',
49
            'c'         => 'text/plain',
50
            'cat'       => 'application/vnd.ms-pkiseccat',
51
            'cdf'       => 'application/x-cdf',
52
            'cer'       => 'application/x-x509-ca-cert',
53
            'class'     => 'application/octet-stream',
54
            'clp'       => 'application/x-msclip',
55
            'cmx'       => 'image/x-cmx',
56
            'cod'       => 'image/cis-cod',
57
            'cpio'      => 'application/x-cpio',
58
            'crd'       => 'application/x-mscardfile',
59
            'crl'       => 'application/pkix-crl',
60
            'crt'       => 'application/x-x509-ca-cert',
61
            'csh'       => 'application/x-csh',
62
            'css'       => 'text/css',
63
            'dcr'       => 'application/x-director',
64
            'der'       => 'application/x-x509-ca-cert',
65
            'dir'       => 'application/x-director',
66
            'dll'       => 'application/x-msdownload',
67
            'dms'       => 'application/octet-stream',
68
            'doc'       => 'application/msword',
69
            'dot'       => 'application/msword',
70
            'dvi'       => 'application/x-dvi',
71
            'dxr'       => 'application/x-director',
72
            'eps'       => 'application/postscript',
73
            'etx'       => 'text/x-setext',
74
            'evy'       => 'application/envoy',
75
            'exe'       => 'application/octet-stream',
76
            'fif'       => 'application/fractals',
77
            'flr'       => 'x-world/x-vrml',
78
            'gif'       => 'image/gif',
79
            'gtar'      => 'application/x-gtar',
80
            'gz'        => 'application/x-gzip',
81
            'h'         => 'text/plain',
82
            'hdf'       => 'application/x-hdf',
83
            'hlp'       => 'application/winhlp',
84
            'hqx'       => 'application/mac-binhex40',
85
            'hta'       => 'application/hta',
86
            'htc'       => 'text/x-component',
87
            'htm'       => 'text/html',
88
            'html'      => 'text/html',
89
            'htt'       => 'text/webviewhtml',
90
            'ico'       => 'image/x-icon',
91
            'ief'       => 'image/ief',
92
            'iii'       => 'application/x-iphone',
93
            'ins'       => 'application/x-internet-signup',
94
            'isp'       => 'application/x-internet-signup',
95
            'jfif'      => 'image/pipeg',
96
            'jpe'       => 'image/jpeg',
97
            'jpeg'      => 'image/jpeg',
98
            'jpg'       => 'image/jpeg',
99
            'js'        => 'application/x-javascript',
100
            'latex'     => 'application/x-latex',
101
            'lha'       => 'application/octet-stream',
102
            'lsf'       => 'video/x-la-asf',
103
            'lsx'       => 'video/x-la-asf',
104
            'lzh'       => 'application/octet-stream',
105
            'm13'       => 'application/x-msmediaview',
106
            'm14'       => 'application/x-msmediaview',
107
            'm3u'       => 'audio/x-mpegurl',
108
            'man'       => 'application/x-troff-man',
109
            'mdb'       => 'application/x-msaccess',
110
            'me'        => 'application/x-troff-me',
111
            'mht'       => 'message/rfc822',
112
            'mhtml'     => 'message/rfc822',
113
            'mid'       => 'audio/mid',
114
            'mny'       => 'application/x-msmoney',
115
            'mov'       => 'video/quicktime',
116
            'movie'     => 'video/x-sgi-movie',
117
            'mp2'       => 'video/mpeg',
118
            'mp3'       => 'audio/mpeg',
119
            'mpa'       => 'video/mpeg',
120
            'mpe'       => 'video/mpeg',
121
            'mpeg'      => 'video/mpeg',
122
            'mpg'       => 'video/mpeg',
123
            'mpp'       => 'application/vnd.ms-project',
124
            'mpv2'      => 'video/mpeg',
125
            'ms'        => 'application/x-troff-ms',
126
            'mvb'       => 'application/x-msmediaview',
127
            'nws'       => 'message/rfc822',
128
            'oda'       => 'application/oda',
129
            'p10'       => 'application/pkcs10',
130
            'p12'       => 'application/x-pkcs12',
131
            'p7b'       => 'application/x-pkcs7-certificates',
132
            'p7c'       => 'application/x-pkcs7-mime',
133
            'p7m'       => 'application/x-pkcs7-mime',
134
            'p7r'       => 'application/x-pkcs7-certreqresp',
135
            'p7s'       => 'application/x-pkcs7-signature',
136
            'pbm'       => 'image/x-portable-bitmap',
137
            'pdf'       => 'application/pdf',
138
            'pfx'       => 'application/x-pkcs12',
139
            'pgm'       => 'image/x-portable-graymap',
140
            'pko'       => 'application/ynd.ms-pkipko',
141
            'pma'       => 'application/x-perfmon',
142
            'pmc'       => 'application/x-perfmon',
143
            'pml'       => 'application/x-perfmon',
144
            'pmr'       => 'application/x-perfmon',
145
            'pmw'       => 'application/x-perfmon',
146
            'pnm'       => 'image/x-portable-anymap',
147
            'pot'       => 'application/vnd.ms-powerpoint',
148
            'ppm'       => 'image/x-portable-pixmap',
149
            'pps'       => 'application/vnd.ms-powerpoint',
150
            'ppt'       => 'application/vnd.ms-powerpoint',
151
            'prf'       => 'application/pics-rules',
152
            'ps'        => 'application/postscript',
153
            'pub'       => 'application/x-mspublisher',
154
            'qt'        => 'video/quicktime',
155
            'ra'        => 'audio/x-pn-realaudio',
156
            'ram'       => 'audio/x-pn-realaudio',
157
            'ras'       => 'image/x-cmu-raster',
158
            'rgb'       => 'image/x-rgb',
159
            'rmi'       => 'audio/mid',
160
            'roff'      => 'application/x-troff',
161
            'rtf'       => 'application/rtf',
162
            'rtx'       => 'text/richtext',
163
            'scd'       => 'application/x-msschedule',
164
            'sct'       => 'text/scriptlet',
165
            'setpay'    => 'application/set-payment-initiation',
166
            'setreg'    => 'application/set-registration-initiation',
167
            'sh'        => 'application/x-sh',
168
            'shar'      => 'application/x-shar',
169
            'sit'       => 'application/x-stuffit',
170
            'snd'       => 'audio/basic',
171
            'spc'       => 'application/x-pkcs7-certificates',
172
            'spl'       => 'application/futuresplash',
173
            'src'       => 'application/x-wais-source',
174
            'sst'       => 'application/vnd.ms-pkicertstore',
175
            'stl'       => 'application/vnd.ms-pkistl',
176
            'stm'       => 'text/html',
177
            'svg'       => 'image/svg+xml',
178
            'sv4cpio'   => 'application/x-sv4cpio',
179
            'sv4crc'    => 'application/x-sv4crc',
180
            't'         => 'application/x-troff',
181
            'tar'       => 'application/x-tar',
182
            'tcl'       => 'application/x-tcl',
183
            'tex'       => 'application/x-tex',
184
            'texi'      => 'application/x-texinfo',
185
            'texinfo'   => 'application/x-texinfo',
186
            'tgz'       => 'application/x-compressed',
187
            'tif'       => 'image/tiff',
188
            'tiff'      => 'image/tiff',
189
            'tr'        => 'application/x-troff',
190
            'trm'       => 'application/x-msterminal',
191
            'tsv'       => 'text/tab-separated-values',
192
            'txt'       => 'text/plain',
193
            'uls'       => 'text/iuls',
194
            'ustar'     => 'application/x-ustar',
195
            'vcf'       => 'text/x-vcard',
196
            'vrml'      => 'x-world/x-vrml',
197
            'wav'       => 'audio/x-wav',
198
            'wcm'       => 'application/vnd.ms-works',
199
            'wdb'       => 'application/vnd.ms-works',
200
            'wks'       => 'application/vnd.ms-works',
201
            'wmf'       => 'application/x-msmetafile',
202
            'wps'       => 'application/vnd.ms-works',
203
            'wri'       => 'application/x-mswrite',
204
            'wrl'       => 'x-world/x-vrml',
205
            'wrz'       => 'x-world/x-vrml',
206
            'xaf'       => 'x-world/x-vrml',
207
            'xbm'       => 'image/x-xbitmap',
208
            'xla'       => 'application/vnd.ms-excel',
209
            'xlc'       => 'application/vnd.ms-excel',
210
            'xlm'       => 'application/vnd.ms-excel',
211
            'xls'       => 'application/vnd.ms-excel',
212
            'xlsx'      => 'vnd.ms-excel',
213
            'xlt'       => 'application/vnd.ms-excel',
214
            'xlw'       => 'application/vnd.ms-excel',
215
            'xof'       => 'x-world/x-vrml',
216
            'xpm'       => 'image/x-xpixmap',
217
            'xwd'       => 'image/x-xwindowdump',
218
            'z'         => 'application/x-compress',
219
            'zip'       => 'application/zip',
220
            // Added
221
            'png'       => 'image/png',
222
        ];
223
        $exploded = explode('.', $file);
0 ignored issues
show
Coding Style introduced by
Equals sign not aligned with surrounding assignments; expected 2 spaces but found 1 space

This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line.

To visualize

$a = "a";
$ab = "ab";
$abc = "abc";

will produce issues in the first and second line, while this second example

$a   = "a";
$ab  = "ab";
$abc = "abc";

will produce no issues.

Loading history...
224
        $extension = end($exploded);
225
        $extension = strtolower($extension);
226
        return isset($mimeTypes[$extension]) ? $mimeTypes[$extension] : 'application/octet-stream';
227
    }
228
229
    /**
230
     * Gets the mime type by looking at the file info.
231
     *
232
     * @param string $file
233
     * the file to get the mimetype from
234
     *
235
     * @return mixed|string
236
     * the mimetype
237
     */
238
    public function getMimeTypeByFileInfo($file) {
239
        $mimeType = 'application/octet-stream';
0 ignored issues
show
Unused Code introduced by
$mimeType is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
240
241
        // Some wrong read mimetypes
242
        $fallBack = ['css', 'js'];
0 ignored issues
show
Coding Style introduced by
Equals sign not aligned with surrounding assignments; expected 2 spaces but found 1 space

This check looks for multiple assignments in successive lines of code. It will report an issue if the operators are not in a straight line.

To visualize

$a = "a";
$ab = "ab";
$abc = "abc";

will produce issues in the first and second line, while this second example

$a   = "a";
$ab  = "ab";
$abc = "abc";

will produce no issues.

Loading history...
243
        $extension = pathinfo($file, PATHINFO_EXTENSION);
244
        if (in_array(strtolower($extension), $fallBack)) {
245
            return $this->getMimeTypeByExtension($file);
246
        }
247
        $finfo    = finfo_open(FILEINFO_MIME_TYPE);
248
        $mimeType = finfo_file($finfo, $file);
0 ignored issues
show
Security File Exposure introduced by
$file can contain request data and is used in file inclusion context(s) leading to a potential security vulnerability.

8 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  4. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  5. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  6. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  7. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  8. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 281
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 1929
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 222
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 240
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  7. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  8. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  9. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  10. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  11. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 271
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 271
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  10. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  11. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  12. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 274
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 274
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  10. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  11. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  12. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 277
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 277
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  10. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  11. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  12. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 347
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 347
  2. $server is assigned
    in vendor/Request.php on line 395
  3. $server is assigned
    in vendor/Request.php on line 396
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 398
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  10. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  11. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  12. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  13. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  14. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 246
  4. $values is assigned
    in vendor/HeaderBag.php on line 31
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  6. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 125
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1699
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1730
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  13. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  14. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  15. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  16. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  17. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 246
  3. $values is assigned
    in vendor/HeaderBag.php on line 31
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  5. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 125
  8. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1699
  9. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1730
  10. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  11. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  12. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  13. Request::get() returns tainted data, and $request->get('file') is passed through str_replace(), and $fileParam is assigned
    in src/CRUDlex/ControllerProvider.php on line 593
  14. $file is assigned
    in src/CRUDlex/ControllerProvider.php on line 594
  15. $file is passed to MimeTypes::getMimeType()
    in src/CRUDlex/ControllerProvider.php on line 600
  16. $file is passed to MimeTypes::getMimeTypeByFileInfo()
    in src/CRUDlex/MimeTypes.php on line 264

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
249
        finfo_close($finfo);
250
        return $mimeType;
251
    }
252
253
    /**
254
     * Function to get the mimetype of a file.
255
     *
256
     * @param string $file
257
     * the file to get the mimetype from
258
     *
259
     * @return mixed|string
260
     * the mimetype
261
     */
262
    public function getMimeType($file) {
263
        if (file_exists($file)) {
264
            return $this->getMimeTypeByFileInfo($file);
265
        }
266
        return $this->getMimeTypeByExtension($file);
267
    }
268
269
}