File Uploads and Images

array (
  'cover' =>
  array (
    'name' => 'cover.png',            // the client's file name: untrusted
    'full_path' => 'cover.png',       // the relative path for directory uploads (8.1): untrusted
    'type' => 'image/png',            // the client's claim: untrusted
    'tmp_name' => '/tmp/phpkmoqof3cgo0l30Xbtqy',
    'error' => 0,                     // UPLOAD_ERR_OK
    'size' => 5512,
  ),
)

array (
  'covers' =>
  array (
    'name' => array (0 => 'cover.png', 1 => 'evil.jpg'),
    'full_path' => array (0 => 'cover.png', 1 => 'evil.jpg'),
    'type' => array (0 => 'image/png', 1 => 'image/jpeg'),
    'tmp_name' => array (0 => '/tmp/phpbqg2pqeap095fOG2Kmv', 1 => '/tmp/php4rr7t2lic8lr2Rr8omU'),
    'error' => array (0 => 0, 1 => 0),
    'size' => array (0 => 5512, 1 => 28),
  ),
)

<?php
// src/CoverUpload.php
declare(strict_types=1);

final class CoverUpload
{
    private const array TYPES = ['image/png' => 'png', 'image/gif' => 'gif', 'image/jpeg' => 'jpg'];
    private const int MAX_BYTES = 2 * 1024 * 1024;

    public function __construct(private readonly string $directory) {}

    /** @param array{error:int,tmp_name:string,size:int,name:string} $file */
    public function store(array $file): string
    {
        if ($file['error'] !== UPLOAD_ERR_OK) {
            throw new RuntimeException(match ($file['error']) {
                UPLOAD_ERR_INI_SIZE, UPLOAD_ERR_FORM_SIZE => 'The file is too large.',
                UPLOAD_ERR_PARTIAL => 'The upload was interrupted.',
                UPLOAD_ERR_NO_FILE => 'Choose a file.',
                default => 'The upload failed.',            // NO_TMP_DIR, CANT_WRITE, EXTENSION
            });
        }
        if (!is_uploaded_file($file['tmp_name']) || $file['size'] > self::MAX_BYTES) {
            throw new RuntimeException('Invalid upload.');
        }

        // Trust the bytes, not the client: the name and type fields are attacker-controlled
        $mime = (new finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);
        $extension = self::TYPES[$mime] ?? throw new RuntimeException("Not an allowed image ($mime).");

        // A generated name: no path traversal, no overwrites, no executable extensions
        $name = bin2hex(random_bytes(16)) . '.' . $extension;
        if (!move_uploaded_file($file['tmp_name'], "{$this->directory}/$name")) {
            throw new RuntimeException('Could not save the file.');
        }
        return $name;
    }
}

<?php
// public/upload.php
declare(strict_types=1);

require __DIR__ . '/../src/CoverUpload.php';

header('Content-Type: text/plain');
if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > ini_parse_quantity(ini_get('post_max_size'))) {
    http_response_code(413);                       // PHP discarded the whole body: $_POST and $_FILES are empty
    echo "Request too large\n";
    return;
}
try {
    $name = (new CoverUpload(__DIR__ . '/../storage/covers'))->store($_FILES['cover'] ?? ['error' => UPLOAD_ERR_NO_FILE]);
    echo "stored as $name\n";
} catch (RuntimeException $e) {
    http_response_code(422);
    echo $e->getMessage(), "\n";
}

$ curl localhost:8000/upload.php -F 'cover=@cover.png'
stored as 4441f408dd8f550b5d71760fc6001681.png
$ curl localhost:8000/upload.php -F 'cover=@evil.jpg;type=image/jpeg'          # PHP code named .jpg
Not an allowed image (text/x-php).
$ curl localhost:8000/upload.php -F 'cover=@big.bin;filename=big.png'          # 1.5 MB, upload_max_filesize=1M
The file is too large.
$ curl -X POST localhost:8000/upload.php -d x=1
Choose a file.
$ curl -w 'status %{http_code}\n' localhost:8000/upload.php -F 'cover=@big.bin'   # with post_max_size=1M
Request too large
status 413

<?php
// public/download.php?file=kindred.png
declare(strict_types=1);

$name = basename($_GET['file'] ?? '');                       // never a path from the client
$path = __DIR__ . "/../storage/covers/$name";
if (!preg_match('/^[a-z0-9-]+\.png$/', $name) || !is_file($path)) {
    http_response_code(404);
    return;
}
// ... check that the current user may see this file ...

header('Content-Type: image/png');
header('Content-Disposition: attachment; filename="' . $name . '"');
header('X-Content-Type-Options: nosniff');
if (($_GET['via'] ?? '') === 'php') {
    header('Content-Length: ' . filesize($path));
    readfile($path);                                          // PHP streams the file
} else {
    header('X-Accel-Redirect: /protected-covers/' . $name);   // Nginx streams it, the worker is free
}

location /protected-covers/ {
    internal;                            # only reachable through X-Accel-Redirect
    alias /app/storage/covers/;
}

$ curl -D - -o kindred.png 'http://bookshelf.test/download.php?file=kindred.png'
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 5512
Content-Disposition: attachment; filename="kindred.png"
$ curl -o /dev/null -w '%{http_code}\n' http://bookshelf.test/protected-covers/kindred.png
404
$ curl -o /dev/null -w '%{http_code}\n' 'http://bookshelf.test/download.php?file=../../etc/passwd'
404

<?php
declare(strict_types=1);

/** Re-encode an uploaded image and write a thumbnail of the given width. */
function makeThumbnail(string $source, string $target, int $width = 300): array
{
    [$w, $h, $type] = getimagesize($source) ?: throw new RuntimeException('Not an image.');
    if ($w * $h > 40_000_000) {
        throw new RuntimeException('Image too large to process.');   // decompression-bomb guard
    }
    $image = imagecreatefromstring(file_get_contents($source)) ?: throw new RuntimeException('Unreadable image.');
    $thumb = imagescale($image, $width);                              // keeps the aspect ratio
    imagepng($thumb, $target, 9);                                     // re-encoding drops anything hidden in the file
    return [$w, $h, image_type_to_mime_type($type), imagesx($thumb), imagesy($thumb)];
}

var_dump(makeThumbnail(__DIR__ . '/../storage/cover.png', __DIR__ . '/../storage/covers/thumb.png'));
// array(5) { [0]=> int(800) [1]=> int(1200) [2]=> string(9) "image/png" [3]=> int(300) [4]=> int(450) }