Autodetect MIME type of uploaded message files?

[mpkut]

The Send an html page option in the wwsympa Post panel allows the user to upload a file that is treated as HTML news letter content. However if a JPG or other image file is uploaded by mistake, the Content-Type header of the message remains "text/html". In that case subscribers receive a base64 encoded document containing what appears to be random noise.

It seems useful to do some content type detection on the uploaded file, and update the message headers to suit. Perhaps some content types should be rejected.

Before we start coding anything to submit along these lines, we have a Perl module bundling question. While we hesitate to suggest adding yet another Perl module requirement to Sympa, File::LibMagic may be a good choice for the task. The module has seen relatively recent updates and is bundled with RHEL 7/CentOS 7 and at least Fedora 30. Would it be agreeable for us to use this module to try to implement content detection for HTML news letter files?

[ikedas]

MIME content type may be restricted by doing like:

diff --git a/src/cgi/wwsympa.fcgi.in b/src/cgi/wwsympa.fcgi.in
index 04436b5..376f863 100644
--- a/src/cgi/wwsympa.fcgi.in
+++ b/src/cgi/wwsympa.fcgi.in
@@ -14692,8 +14692,11 @@ sub do_send_mail {
         my $page_source;
         if ($in{'uploaded_file'} =~ /\S/) {
             my $fh = $query->upload('uploaded_file');
-            unless ($fh) {
-                wwslog('err', 'Can\'t upload %s', $in{'uploaded_file'});
+            my $ctype = $query->uploadInfo($fh)->{'Content-Type'}
+                if $fh;
+            unless ($ctype and lc $ctype eq 'text/html') {
+                wwslog('err', 'Can\'t upload %s (%s)', $in{'uploaded_file'},
+                    $ctype || 'unknown type');
                 Sympa::WWW::Report::reject_report_web(
                     'intern',
                     'cannot_upload',

However, it will be easily outwitted.

[mpkut]

This change seems like an improvement on its own and would cover the most common cases of uploading an image file by mistake. There may still be room to consider whether it would be worthwhile to inspect the contents of the uploaded file as well. That's where a "magic cookie" module seemed like a good fit, but not without agreement from the development team on which of the likely available modules would be agreeable.

Thank you!