1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
<?php
/**
* Copyright (c) 2013 Robin Appelman <icewind@owncloud.com>
* This file is licensed under the Affero General Public License version 3 or
* later.
* See the COPYING-README file.
*/
namespace OC\Files\Type;
/**
* Class Detection
*
* Mimetype detection
*
* @package OC\Files\Type
*/
class Detection {
protected $mimetypes = array();
protected $secureMimeTypes = array();
/**
* Add an extension -> mimetype mapping
*
* $mimetype is the assumed correct mime type
* The optional $secureMimeType is an alternative to send to send
* to avoid potential XSS.
*
* @param string $extension
* @param string $mimetype
* @param string|null $secureMimeType
*/
public function registerType($extension, $mimetype, $secureMimeType = null) {
$this->mimetypes[$extension] = array($mimetype, $secureMimeType);
$this->secureMimeTypes[$mimetype] = $secureMimeType ?: $mimetype;
}
/**
* Add an array of extension -> mimetype mappings
*
* The mimetype value is in itself an array where the first index is
* the assumed correct mimetype and the second is either a secure alternative
* or null if the correct is considered secure.
*
* @param array $types
*/
public function registerTypeArray($types) {
$this->mimetypes = array_merge($this->mimetypes, $types);
// Update the alternative mimetypes to avoid having to look them up each time.
foreach ($this->mimetypes as $mimeType) {
$this->secureMimeTypes[$mimeType[0]] = $mimeType[1] ?: $mimeType[0];
}
}
/**
* detect mimetype only based on filename, content of file is not used
*
* @param string $path
* @return string
*/
public function detectPath($path) {
if (strpos($path, '.')) {
//try to guess the type by the file extension
$extension = strtolower(strrchr(basename($path), "."));
$extension = substr($extension, 1); //remove leading .
return (isset($this->mimetypes[$extension]) && isset($this->mimetypes[$extension][0]))
? $this->mimetypes[$extension][0]
: 'application/octet-stream';
} else {
return 'application/octet-stream';
}
}
/**
* detect mimetype based on both filename and content
*
* @param string $path
* @return string
*/
public function detect($path) {
if (@is_dir($path)) {
// directories are easy
return "httpd/unix-directory";
}
$mimeType = $this->detectPath($path);
if ($mimeType === 'application/octet-stream' and function_exists('finfo_open')
and function_exists('finfo_file') and $finfo = finfo_open(FILEINFO_MIME)
) {
$info = @strtolower(finfo_file($finfo, $path));
finfo_close($finfo);
if ($info) {
$mimeType = substr($info, 0, strpos($info, ';'));
return empty($mimeType) ? 'application/octet-stream' : $mimeType;
}
}
$isWrapped = (strpos($path, '://') !== false) and (substr($path, 0, 7) === 'file://');
if (!$isWrapped and $mimeType === 'application/octet-stream' && function_exists("mime_content_type")) {
// use mime magic extension if available
$mimeType = mime_content_type($path);
}
if (!$isWrapped and $mimeType === 'application/octet-stream' && \OC_Helper::canExecute("file")) {
// it looks like we have a 'file' command,
// lets see if it does have mime support
$path = escapeshellarg($path);
$fp = popen("file -b --mime-type $path 2>/dev/null", "r");
$reply = fgets($fp);
pclose($fp);
//trim the newline
$mimeType = trim($reply);
if (empty($mimeType)) {
$mimeType = 'application/octet-stream';
}
}
return $mimeType;
}
/**
* detect mimetype based on the content of a string
*
* @param string $data
* @return string
*/
public function detectString($data) {
if (function_exists('finfo_open') and function_exists('finfo_file')) {
$finfo = finfo_open(FILEINFO_MIME);
return finfo_buffer($finfo, $data);
} else {
$tmpFile = \OC_Helper::tmpFile();
$fh = fopen($tmpFile, 'wb');
fwrite($fh, $data, 8024);
fclose($fh);
$mime = $this->detect($tmpFile);
unset($tmpFile);
return $mime;
}
}
/**
* Get a secure mimetype that won't expose potential XSS.
*
* @param string $mimeType
* @return string
*/
public function getSecureMimeType($mimeType) {
return isset($this->secureMimeTypes[$mimeType])
? $this->secureMimeTypes[$mimeType]
: 'application/octet-stream';
}
}
|
