Upload saved with the original file name
Why it matters
Keeping the original file name lets an attacker upload shell.php into a public folder and run it. A random name, a real type check and storage outside the web root stop this.
move_uploaded_file($_FILES['f']['tmp_name'], 'uploads/' . $_FILES['f']['name']);$tmp = $_FILES['f']['tmp_name'];
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($tmp);
$ext = ['image/png' => 'png', 'image/jpeg' => 'jpg'][$mime] ?? null;
if ($ext === null) {
exit('Images only');
}
$name = bin2hex(random_bytes(16)) . '.' . $ext;
move_uploaded_file($tmp, '/var/app-uploads/' . $name);How to fix
Generate a random name with bin2hex(random_bytes(16)), check the MIME type with finfo and store outside the web root.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.