FileUploadHandler::handleExtensionValidation does not have fallback for sites still using file_validate_extensions

Created on 16 October 2023, 9 months ago
Updated 25 October 2023, 8 months ago

Problem/Motivation

file_validate_extensions was deprecated in favor of constraint validators in πŸ“Œ Move file upload validation from file.module to constraint validators Fixed

Until Drupal 11, file_validate_extensions should continue to work as it always did. However, FileUploadHandler::handleExtensionValidation does not have a BC layer, and if $validators['FileExtension'] is not found, then DEFAULT_EXTENSIONS is used instead of the extensions configured by file_validate_extensions

protected function handleExtensionValidation(array &$validators): string {
    // Build a list of allowed extensions.
    if (isset($validators['FileExtension'])) {
      if (!isset($validators['FileExtension']['extensions'])) {
        // If 'FileExtension' is set and the list is empty then the caller wants
        // to allow any extension. In this case we have to remove the validator
        // or else it will reject all extensions.
        unset($validators['FileExtension']);
      }
    }
    else {
      // No validator was provided, so add one using the default list.
      // Build a default non-munged safe list for
      // \Drupal\system\EventSubscriber\SecurityFileUploadEventSubscriber::sanitizeName().
      $validators['FileExtension'] = ['extensions' => self::DEFAULT_EXTENSIONS];
    }
    return $validators['FileExtension']['extensions'] ?? '';
  }

A fix for this should go in the 10x branch, but isn't needed in 11 since file_validate_extensions support is removed.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Fixed

Version

10.2 ✨

Component
File systemΒ  β†’

Last updated about 8 hours ago

Created by

πŸ‡ΊπŸ‡ΈUnited States bnjmnm Ann Arbor, MI

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024