V2.15 Image Exploit Checking Problems (invalid function call/ invalid extension errors)

There are several issues that reflect this that I will be marking as duplicates of this. It just seemed cleaner to start a new issue to deal with the core problem, which is problems with the new exploit checking code.

Problem Definition

Symptom of this may take a couple of forms:

• You get an invalid extension error for all image files.
• You may get a "Fatal Error. Call to undefined function mime_content_type()" error.

The underlying problem is that Webfm is now checking to make sure that images are not XSS (Cross Site Scripting) attacks. It is doing this by using on of two PhP Extensions. Either the newer FileInfo 5.3 / PECL < 5.3 extension or the older mime_magic extensions (PhP < 5.3). These extensions are the best way to do this because they don't depend on the file extension but try to look at the file contents to determine the mime type (e.g. does a PNG file start with a PNG tag, etc.).

The undefined function error happens if the neither of these extensions are enabled.

The problem with all images being invalid is that both these extensions depend on a "magic mime" file that defines the tests used to determine the mime type from the file data. In researching these problems, it is apparent that getting the correct file and configuring it can be problematic. If the magic file can not be found or is invalid, these functions tend to just return "" for the mime type without reporting an error.

Proposed Solution

The current code makes the assumption that the extension being used has been correctly installed and is working. Given the number of issues reported, this is not the case for a large number of people. Given that some people may have to deal with web providers to change this or may not have the technical knowledge to get the extension working, I'm proposing the following code to solve this.

This code will attempt to use the extensions, but if they do not exist or do not return a mime type, it will fall back on the Drupal standard test (used when you upload profile images). This test is not quite as good as the extension test, but work for most common images.

A patch will be forth coming but in the meantime, here is the manual method of updating to this new code.

In the V2.15 webfm.module file, find this section of code which start at line 2784.

  //Check for possible imagefile exploit
  //Trying to determine the files mimetype with php
  //Later we compare the determined mimetype to the one drupal determines.
  //Drupal (file_get_mimetype) determines the mimetype by mapping the file extension.
  $mimetype = ""; //mimetype string
  $extension_error = FALSE;
  if (extension_loaded('fileinfo')) {
    //use Fileinfo extension
    static $finfo = FALSE;
    if ($finfo || $finfo = @finfo_open(FILEINFO_MIME_TYPE)) {
      $mimetype = $finfo->file($file->filepath);
    }
  }
  else {
    $mimetype = mime_content_type($file->filepath);
  }
  
  if (strpos($mimetype,'image') !== FALSE AND strpos(file_get_mimetype($file->filepath),'image') !== FALSE) {
    //both our $mimetype-check and drupal report this to be an image
    //we double check with getimagesize
    if (!@getimagesize($file->filepath)) {
      $extension_error = TRUE;
    }
  }
  elseif (strpos($mimetype,'image') !== FALSE OR strpos(file_get_mimetype($file->filepath),'image') !== FALSE) {
    //only one of the checks thinks this is an image.
    //this covers both cases:
    // * javascript/text-file with a wrong extension
    // * image file with a wrong, e.g. "txt" extension
    $extension_error = TRUE;
   }

Replace the code above with this new code

  // Begin check for possible imagefile exploits
  // Does the extension map to an image mime type?
  $isExtImage = strpos(file_get_mimetype($file->filepath),'image') !== FALSE;
  // Only test files with image extensions
  if ( $isExtImage ) {
    // Try to determine the files mimetype with php extensions
    $mimetype = ""; //mimetype string
    $extension_error = FALSE;
    // use Fileinfo extension
    if (extension_loaded('fileinfo')) {
      static $finfo = FALSE;
      if ($finfo || $finfo = @finfo_open(FILEINFO_MIME_TYPE)) {
        $mimetype = $finfo->file($file->filepath);
      }
    }
    // Use mime magic extensions
    elseif ( function_exists('mime_content_type') ) {
      $mimetype = mime_content_type($file->filepath);
    }
    // No extension found
    else {
      // probably should be a warning to admin about no extensions.
      $mimetype = '';
    }
    
    // Does the php extension "magic" mimetype function map to an image?
    $isImage = strpos($mimetype,'image') !== FALSE;
  
    // Test to see if php extension was found.  This may be empty if PhP
    // extension was set up wrong (bad or non-existent magic file).
    if ( ! empty($mimetype)  ) {
      // Both our $mimetype-check and drupal report this to be an image
      if ( $isImage AND $isExtImage ) {
        // we double check with getimagesize
        if (!@getimagesize($file->filepath)) {
          $extension_error = TRUE;
        }
      }
      // only one of the checks thinks this is an image.
      // this covers both cases:
      // * javascript/text-file with a wrong extension
      // * image file with a wrong, e.g. "txt" extension
      elseif ( $isImage OR $isExtImage ) {
        $extension_error = TRUE;
      }
    }
    // File extension says image but can't get php extension mimetype.
    // So we test by trying to get image size (only works for common
    // types of png, bmp, gif, and jpeg).
    else {
      if (!@getimagesize($file->filepath)) {
        $extension_error = TRUE;
      }
    }
  }