From 526e51eb3336acc1008adaebce0d85eacc2746f7 Mon Sep 17 00:00:00 2001
From: Paul Robert <dev@paulrobert.xyz>
Date: Sun, 10 Sep 2023 22:58:58 +0100
Subject: [PATCH] Added more image types.

---
 Helga/Functions/filevalidator.php | 61 +++++++++++++++++++++++--------
 Tests/CustomMessagesTest.php      |  2 +
 Tests/FilesTest.php               |  1 +
 3 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/Helga/Functions/filevalidator.php b/Helga/Functions/filevalidator.php
index 1f6777e..83831cf 100644
--- a/Helga/Functions/filevalidator.php
+++ b/Helga/Functions/filevalidator.php
@@ -7,14 +7,18 @@
 const PDF_MAGIC = "\x25\x50\x44\x46\x2D";
 const OFFICE_MAGIC = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1";
 
+
 function hasCode(string $string)
 {
     return (
         (strpos($string, "<?php") !== false) ||
         (strpos($string, " echo ") !== false) ||
-        (strpos($string, "__halt_compiler") !== false) ||           
-        preg_match("/\b\$_GET+/", $string) ||
-        preg_match("/\b\$_POST+/", $string)
+        (strpos($string, "__halt_compiler") !== false) ||
+        preg_match("/\b\$_GET.+/", $string) ||
+        preg_match("/\b\$_POST.+/", $string) ||
+        preg_match("/\b\$_REQUEST.+/", $string) ||
+        preg_match("/\b\$_COOKIE.+/", $string) ||
+        preg_match("/\b\$_SESSION.+/", $string)
     );
 }
 
@@ -33,8 +37,8 @@ function containsCode(array $headers)
 
 function rawContainsCode(string $path)
 {
-    $contents = file_get_contents($path);      
-    if(hasCode($contents)){
+    $contents = file_get_contents($path);
+    if (hasCode($contents)) {
         return true;
     }
 }
@@ -51,7 +55,7 @@ function hasMime(string $path, array $mimes)
 {
     if (rawContainsCode($path)) {
         return false;
-    }    
+    }
 
     $fn = new finfo(FILEINFO_MIME);
     $mime = $fn->file($path);
@@ -70,20 +74,43 @@ function hasMime(string $path, array $mimes)
 function isImage(string $path)
 {
 
-    if (!is_readable($path)) {          
+    if (!is_readable($path)) {
         return false;
-    }    
+    }
 
-    $supported = [IMAGETYPE_GIF, IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_WEBP];
+    $supported = [IMAGETYPE_GIF, IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_WEBP, IMAGETYPE_BMP, IMAGETYPE_XBM, IMAGETYPE_WBMP];
 
     $type = @exif_imagetype($path);
-    if (!in_array($type, $supported)) {        
+    if (!in_array($type, $supported)) {
         return false;
     }
 
-    if (!hasMime($path, ['image/jpeg', 'image/png', 'image/gif', 'image/webp'])) {        
+    if (!hasMime($path, [
+        'image/jpeg',
+        'image/jpg',
+        'image/pjpeg',
+
+        'image/png',
+        'image/x-png',
+
+        'image/gif',
+
+        'image/webp',
+        'image/x-webp',
+
+
+        'image/bmp',
+        'image/ms-bmp',
+        'image/x-bitmap',
+        'image/x-bmp',
+        'image/x-ms-bmp',
+        'image/x-win-bitmap',
+        'image/x-windows-bmp',
+        'image/x-bitmap',
+
+    ])) {
         return false;
-    }    
+    }
 
     $data = @exif_read_data($path);
     if (is_array($data)) {
@@ -110,6 +137,10 @@ function isImage(string $path)
         case IMAGETYPE_WEBP:
             $image = imagecreatefromwebp($path);
             break;
+        case IMAGETYPE_BMP:
+        case IMAGETYPE_XBM:
+            $image = imagecreatefromwebp($path);
+            break;           
     }
     return (!!$image);
 }
@@ -122,10 +153,10 @@ function isImage(string $path)
  * @return bool
  */
 function isPDF($path)
-{    
-    if (!is_readable($path) || !hasMime($path, ['application/pdf', 'application/x-pdf'])) {        
+{
+    if (!is_readable($path) || !hasMime($path, ['application/pdf', 'application/x-pdf'])) {
         return false;
-    }    
+    }
     return (file_get_contents($path, false, null, 0, strlen(PDF_MAGIC)) === PDF_MAGIC) ? true : false;
 }
 
diff --git a/Tests/CustomMessagesTest.php b/Tests/CustomMessagesTest.php
index 08403cc..960d270 100644
--- a/Tests/CustomMessagesTest.php
+++ b/Tests/CustomMessagesTest.php
@@ -6,6 +6,8 @@
 
 class CustomMessagesTest extends TestCase
 {
+    private $customMessage = "";
+    
     protected function setUp(): void
     {
         $this->customMessage = "This is my custom message";
diff --git a/Tests/FilesTest.php b/Tests/FilesTest.php
index be54425..93e0e4e 100644
--- a/Tests/FilesTest.php
+++ b/Tests/FilesTest.php
@@ -6,6 +6,7 @@
 
 class FilesTest extends TestCase
 {
+    private $base = "";
 
     protected function setUp(): void
     {