InsecureFilenameSanitizerPreProcessor.php

Go to the documentation of this file.

<?php
 
namespace ILIAS\FileUpload\Processor;
 
final class InsecureFilenameSanitizerPreProcessor extends AbstractRecursiveZipPreProcessor implements PreProcessor
{
    private $prohibited_names = [
        '...'
    ];
 
    protected function checkPath(string $path) : bool
    {
        $path = str_replace('\\', '/', $path);
        $path = preg_replace('/\/+/', '/', $path);
        $path = trim($path, '/');
        $parts = explode('/', $path);
        foreach ($parts as $part) {
            if (in_array($part, $this->prohibited_names)) {
                return false;
            }
        }
        return true;
    }
 
    protected function getRejectionMessage() : string
    {
        return 'A Security Issue has been detected, File-upload aborted...';
    }
 
    protected function getOKMessage() : string
    {
        return 'Extension is not blacklisted.';
    }
}