wordpress-playground icon indicating copy to clipboard operation
wordpress-playground copied to clipboard

Infer the mime type for the uploaded files from their byte contents instead of their extension

Open adamziel opened this issue 2 years ago • 0 comments

https://github.com/WordPress/wordpress-wasm/pull/48 Introduced a support for file uploads. Unfortunately, it infers the Content-type based on the file extension. This is unsafe, unreliable, and may lead to code execution vulnerabilities if a PHP file is uploaded with a different extension. Let's infer the Content-type from the file contents instead of its extension.

adamziel avatar Oct 17 '22 03:10 adamziel