Remove double extensions from filenames #2556

This commit is contained in:
Kijin Sung 2025-05-22 23:10:19 +09:00
parent 464985b1ef
commit 8291cd671e
2 changed files with 8 additions and 1 deletions

View file

@ -34,6 +34,9 @@ class FilenameFilter
$filename = preg_replace('/__+/', '_', $filename);
$filename = preg_replace('/\.\.+/', '.', $filename);
// Remove potentially misleading double extensions.
$filename = preg_replace('/\.(?:php[\d|s]?|txt|pdf|zip|com|exe|bat|msi|scr|jsp|aspx?|docx?|xlsx?|pptx?|hwpx?)\s?(\.[a-z0-9]+)$/', '$1', $filename);
// Change .php files to .phps to make them non-executable.
if (strtolower(substr($filename, strlen($filename) - 4)) === '.php')
{

View file

@ -28,7 +28,11 @@ class FilenameFilterTest extends \Codeception\Test\Unit
// PHP extension
'foobar.php' => 'foobar.phps',
'foobar.php.jpg' => 'foobar.php.jpg',
'foobar.php.jpg' => 'foobar.jpg',
// Double extension
'Photos.docx .exe' => 'Photos.exe',
'Photos.png.php.jpg' => 'Photos.png.jpg',
// Overlong filenames
str_repeat('f', 200) . '.' . str_repeat('b', 30) => str_repeat('f', 111) . '.' . str_repeat('b', 15),