Repository navigation
Enhance UploadedFile to replace blacklisted extensions with configurable whitelisted formats #340
Description
Currently, the Quantum\Libraries\Storage\UploadedFile class uses a blacklist-based validation approach via the $blacklistedExtensions property to filter dangerous file types.
While this provides some protection, blacklist strategies are generally weaker and harder to maintain securely, as new risky extensions can always appear. A whitelist approach would be more reliable and secure by default.
Proposed changes
- Remove the
$blacklistedExtensionsproperty and relatedwhitelisted()method logic. - Introduce a new
$allowedMimeTypesproperty with a secure default whitelist, e.g.:
protected $allowedMimeTypes = [
'image/jpeg' => ['jpg', 'jpeg'],
'image/png' => ['png'],
'application/pdf' => ['pdf'],
];
Add a setter method:
public function setAllowedMimeTypes(array $map): UploadedFile
{
$this->allowedMimeTypes = $map;
return $this;
}
Add internal validation method:
protected function allowed(string $extension, string $mimeType): bool
{
return isset($this->allowedMimeTypes[$mimeType]) &&
in_array($extension, $this->allowedMimeTypes[$mimeType]);
}
Expected behavior
- Core should define a minimal secure whitelist of file types.
- Applications should be able to extend or override the whitelist:
- Via a configuration file (e.g. /shared/config/uploads.php), and
- Via setter methods on the UploadedFile class for runtime adjustments.
- The save() logic should validate uploads against this whitelist instead of the blacklist.
- The
$blacklistedExtensionsproperty should be removed entirely.
Default behavior will remain compatible for common safe file types. Applications using additional formats can easily register them through configuration or setter methods. Unit tests will ensure behavior remains consistent.
Activity
mamoonbgc036 commentedon Oct 25, 2025
@armanist facing following issue when run on my local machine after
composer installD:\openSource\quantum-php-core(master -> origin)
λ ls
_config.yml composer.json composer.lock CONTRIBUTING.md coverage.xml LICENSE phpunit.xml README.md src/ tests/ vendor/
D:\openSource\quantum-php-core(master -> origin)
λ php qt serve
Could not open input file: qt
armanist commentedon Oct 25, 2025
Hi @mamoonbgc036 please make sure you run the
php qt servefrom the inside of the project directory. Please check theqtfile exists inside the project directory.armanist commentedon Oct 25, 2025
@mamoonbgc036 Just to clarify — the
php qt servecommand is part of the Quantum PHP Project, not the core framework.The repository you cloned I assume (quantum-php-core) is the core framework itself, which doesn’t include the
qtCLI tool because it’s meant to be required by projects (like quantum-php-project) via Composer.So if you’re contributing to the core framework, you don’t need to run
php qt serve— just install dependencies and run the tests:If you want to see the framework in action, clone the starter project instead:
That one includes the CLI and demo modules to test Quantum end-to-end.
The current CONTRIBUTING.md might be a bit confusing on this point — I’ll update it soon to make the setup steps clearer.
Let me know if there’s anything I can help with.
mamoonbgc036 commentedon Oct 25, 2025
thanks @armanist for the clarification. actually i want to work on the above issue.
armanist commentedon Oct 31, 2025
@mamoonbgc036 is there any help required?
Merge pull request #361 from grigoryanmartin20/feature/#340-Enhance-U…