InsecureFilenameSanitizerPreProcessor.php

Go to the documentation of this file.

<?php

namespace ILIAS\FileUpload\Processor;

final class InsecureFilenameSanitizerPreProcessor extends AbstractRecursiveZipPreProcessor implements PreProcessor
{
    private array $prohibited_names = [
        '...'
    ];

    protected function checkPath(string $path): bool
    {
        $path = str_replace('\\', '/', $path);
        $path = preg_replace('/\/+/', '/', $path);
        $path = trim($path, '/');
        $parts = explode('/', $path);
        foreach ($parts as $part) {
            if (in_array($part, $this->prohibited_names)) {
                return false;
            }
        }
        return true;
    }

    protected function getRejectionMessage(): string
    {
        return 'A Security Issue has been detected, File-upload aborted...';
    }

    protected function getOKMessage(): string
    {
        return 'Extension is not blacklisted.';
    }
}