fix(security): disallow file extensions start with php

Author: streamtw

src/LfmUploadValidator.php

@@ -81,6 +81,10 @@ public function extensionIsNotExcutable($excutable_extensions)
             throw new ExcutableFileException();
         }
 
+        if (strpos($extension, 'php') === 0) {
+            throw new ExcutableFileException();
+        }
+
         return $this;
     }
 

tests/LfmUploadValidatorTest.php

@@ -168,6 +168,18 @@ public function testFailsExtensionIsNotExcutableWithExtensionNotLowerCase()
         $validator->extensionIsNotExcutable(['php', 'html']);
     }
 
+    public function testFailsExtensionIsNotExcutableWithExtensionsStartsWithPhp()
+    {
+        $uploaded_file = m::mock(UploadedFile::class);
+        $uploaded_file->shouldReceive('getClientOriginalExtension')->andReturn('php8');
+
+        $validator = new LfmUploadValidator($uploaded_file);
+
+        $this->expectException(ExcutableFileException::class);
+
+        $validator->extensionIsNotExcutable(['php', 'html']);
+    }
+
     public function testFailsExtensionIsValidWithSpecialCharacters()
     {
         $uploaded_file = m::mock(UploadedFile::class);