FileUploadHandler::handleExtensionValidation does not have fallback for sites still using file_validate_extensions

Created on 16 October 2023, about 1 year ago
Updated 25 October 2023, about 1 year ago

Problem/Motivation

file_validate_extensions was deprecated in favor of constraint validators in πŸ“Œ Move file upload validation from file.module to constraint validators Fixed

Until Drupal 11, file_validate_extensions should continue to work as it always did. However, FileUploadHandler::handleExtensionValidation does not have a BC layer, and if $validators['FileExtension'] is not found, then DEFAULT_EXTENSIONS is used instead of the extensions configured by file_validate_extensions

protected function handleExtensionValidation(array &$validators): string {
    // Build a list of allowed extensions.
    if (isset($validators['FileExtension'])) {
      if (!isset($validators['FileExtension']['extensions'])) {
        // If 'FileExtension' is set and the list is empty then the caller wants
        // to allow any extension. In this case we have to remove the validator
        // or else it will reject all extensions.
        unset($validators['FileExtension']);
      }
    }
    else {
      // No validator was provided, so add one using the default list.
      // Build a default non-munged safe list for
      // \Drupal\system\EventSubscriber\SecurityFileUploadEventSubscriber::sanitizeName().
      $validators['FileExtension'] = ['extensions' => self::DEFAULT_EXTENSIONS];
    }
    return $validators['FileExtension']['extensions'] ?? '';
  }

A fix for this should go in the 10x branch, but isn't needed in 11 since file_validate_extensions support is removed.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Fixed

Version

10.2 ✨

Component
File systemΒ  β†’

Last updated about 12 hours ago

Created by

πŸ‡ΊπŸ‡ΈUnited States bnjmnm Ann Arbor, MI

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024