[SECURITY] Enclose file type scope when invoking ImageMagick
In order to enclose and avoid type guessing done by ImageMagick based on mime-type and internal file content checks, new value object class ImageMagickFile has been introduced as guard for those invocations. Resolves: #87588 Releases: master, 9.5, 8.7 Security-Commit: d4f18684b2b2078b51cc7e93abdb251ea846984a Security-Bulletin: TYPO3-CORE-SA-2019-012 Change-Id: I9a2dd74e8548530d7bc83bd18af2f4f0a8212019 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/60705 Tested-by:Oliver Hader <oliver.hader@typo3.org> Reviewed-by:
Oliver Hader <oliver.hader@typo3.org>
Showing
- typo3/sysext/core/Classes/Imaging/GraphicalFunctions.php 18 additions, 9 deletionstypo3/sysext/core/Classes/Imaging/GraphicalFunctions.php
- typo3/sysext/core/Classes/Imaging/ImageMagickFile.php 223 additions, 0 deletionstypo3/sysext/core/Classes/Imaging/ImageMagickFile.php
- typo3/sysext/core/Classes/Resource/OnlineMedia/Processing/PreviewProcessing.php 4 additions, 4 deletions...ses/Resource/OnlineMedia/Processing/PreviewProcessing.php
- typo3/sysext/core/Classes/Resource/Processing/LocalPreviewHelper.php 4 additions, 4 deletions...t/core/Classes/Resource/Processing/LocalPreviewHelper.php
- typo3/sysext/core/Classes/Type/File/FileInfo.php 42 additions, 1 deletiontypo3/sysext/core/Classes/Type/File/FileInfo.php
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.ai 1018 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.ai
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.bmp 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.bmp
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.eps 7842 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.eps
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.fax 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.fax
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.gif 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.gif
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.jpg 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.jpg
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.pdf 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.pdf
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.png 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.png
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.ps 7843 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.ps
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.svg 44 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.svg
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.tif 0 additions, 0 deletionstypo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.tif
- typo3/sysext/core/Tests/Functional/Imaging/Fixtures/file.webp 0 additions, 0 deletions...3/sysext/core/Tests/Functional/Imaging/Fixtures/file.webp
- typo3/sysext/core/Tests/Functional/Imaging/ImageMagickFileTest.php 353 additions, 0 deletions...ext/core/Tests/Functional/Imaging/ImageMagickFileTest.php
Please register or sign in to comment