Skip to content

fix: mediapool: block dangerous extensions in any filename segment #6538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gharlan merged 2 commits into from
Jun 1, 2026
+12 −13
Merged

fix: mediapool: block dangerous extensions in any filename segment #6538

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
929185c
fix(mediapool): block dangerous extensions in any filename segment
gharlan May 30, 2026
f579a8f
chore: update psalm baseline
gharlan Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions .tools/psalm/baseline.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1256,13 +1256,6 @@
<MixedArgument>
<code><![CDATA[$args['types']]]></code>
</MixedArgument>
<MixedAssignment>
<code><![CDATA[$blockedExtension]]></code>
</MixedAssignment>
<MixedOperand>
<code><![CDATA[$blockedExtension]]></code>
<code><![CDATA[$blockedExtension]]></code>
</MixedOperand>
<MixedReturnStatement>
<code><![CDATA[rex_addon::get('mediapool')->getProperty('allowed_mime_types', [])]]></code>
<code><![CDATA[rex_addon::get('mediapool')->getProperty('blocked_extensions')]]></code>
Expand Down
12 changes: 6 additions & 6 deletions redaxo/src/addons/mediapool/lib/mediapool.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,13 +114,13 @@ public static function isAllowedExtension(string $filename, array $args = []): b
return false;
}

// A blocked extension must not appear as a dot-separated segment anywhere in the filename,
// to prevent double/multi extension vulnerabilities: some webspaces execute a file named
// e.g. `foo.php.txt` or `foo.php.any.jpg` as php. Matching whole segments (instead of a
// substring) avoids false positives like `foo.json` (contains `.js`) or `js_datei.txt`.
$blockedExtensions = self::getBlockedExtensions();
foreach ($blockedExtensions as $blockedExtension) {
// $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
// -> some webspaces execute files named file.php.txt as php
if (str_ends_with($filename, '.' . $blockedExtension) // Prüfe ob der String mit der verbotenen Endung endet
|| str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt) // prüfe ob es keine doppelte Endung der Form *.php.ext gibt
) {
foreach (explode('.', mb_strtolower($filename)) as $segment) {
if (in_array($segment, $blockedExtensions, true)) {
return false;
}
}
Expand Down
6 changes: 6 additions & 0 deletions redaxo/src/addons/mediapool/tests/mediapool_test.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,15 @@ public static function provideIsAllowedExtension(): array
[false, '.htaccess'],
[false, '.htpasswd'],
[false, 'foo.js.txt'],
[false, 'foo.js.any.txt'],
[false, 'shell.php.any.jpg'],
[false, 'shell.PHP.any.JPG'],
[false, 'shell.phtml.any.jpg'],
[true, 'js_datei.txt'],
[true, 'foo.json'],
[true, 'foo.any.json'],
[true, 'php_logo.jpg'],
[true, 'php_logo.any.jpg'],
[true, 'foo.bar.png', ['types' => 'jpg,png,gif']],
[false, 'foo.bar.txt', ['types' => 'jpg,png,gif']],
[false, 'foo.bar.php', ['types' => 'jpg,png,gif,php']],
Expand Down