fix: validate icons to be images (#1173)

app/Helper.php

@@ -112,10 +112,17 @@ function className($name)
 
 /**
  * @param string $file
+ * @param string $extension
  * @return bool
  */
-function isImage(string $file):bool
+function isImage(string $file, string $extension): bool
 {
+    $allowedExtensions = ['jpg', 'jpeg', 'png', 'bmp', 'gif', 'svg', 'webp'];
+
+    if (!in_array($extension, $allowedExtensions)) {
+        return false;
+    }
+
     $tempFileName = tempnam("/tmp", "image-check-");
     $handle = fopen($tempFileName, "w");
 

app/Http/Controllers/ItemController.php

@@ -197,6 +197,7 @@ class ItemController extends Controller
      * @param Request $request
      * @param null $id
      * @return Item
+     * @throws ValidationException
      */
     public static function storelogic(Request $request, $id = null): Item
     {
@@ -219,21 +220,18 @@ class ItemController extends Controller
                     "verify_peer_name" => false,
                 ),
             );
+
+            $file = $request->input('icon');
+            $path_parts = pathinfo($file);
+            $extension = $path_parts['extension'];
+
             $contents = file_get_contents($request->input('icon'), false, stream_context_create($options));
 
-            if (!isImage($contents)) {
+            if (!isImage($contents, $extension)) {
                 throw ValidationException::withMessages(['file' => 'Icon must be an image.']);
             }
 
-            if ($application) {
-                $icon = $application->icon;
-            } else {
-                $file = $request->input('icon');
-                $path_parts = pathinfo($file);
-                $icon = md5($contents);
-                $icon .= '.' . $path_parts['extension'];
-            }
-            $path = 'icons/' . $icon;
+            $path = 'icons/' . ($application ? $application->icon : md5($contents) . '.' . $extension);
 
             // Private apps could have here duplicated icons folder
             if (strpos($path, 'icons/icons/') !== false) {

tests/Unit/helpers/IsImageTest.php

@@ -9,9 +9,21 @@ class IsImageTest extends TestCase
     /**
      * @return void
      */
-    public function test_isImage_returns_false_when_file_is_not_image()
+    public function test_returns_true_when_file_is_image()
     {
-        $actual = isImage("<?php ?>");
+        $file = file_get_contents(__DIR__ . '/fixtures/heimdall-icon-small.png');
+
+        $actual = isImage($file, 'png');
+
+        $this->assertTrue($actual);
+    }
+
+    /**
+     * @return void
+     */
+    public function test_returns_false_when_file_extension_is_image_but_content_is_not()
+    {
+        $actual = isImage("<?php ?>", "png");
 
         $this->assertFalse($actual);
     }
@@ -19,24 +31,12 @@ class IsImageTest extends TestCase
     /**
      * @return void
      */
-    public function test_isImage_returns_true_when_file_is_image()
+    public function test_returns_false_when_file_extension_is_not_image_but_content_is()
     {
         $file = file_get_contents(__DIR__ . '/fixtures/heimdall-icon-small.png');
 
-        $actual = isImage($file);
+        $actual = isImage($file, 'php');
 
-        $this->assertTrue($actual);
-    }
-
-    /**
-     * @return void
-     */
-    public function test_isImage_returns_false_when_file_is_php_but_png()
-    {
-        $file = file_get_contents(__DIR__ . '/fixtures/heimdall-icon-small-php.php');
-
-        $actual = isImage($file);
-
-        $this->assertTrue($actual);
+        $this->assertFalse($actual);
     }
 }