Improve content type detection for .dotx, .ai, and others.

carrierwaveuploader / carrierwave

Classier solution for file uploads for Rails, Sinatra and other Ruby web frameworks

https://github.com/carrierwaveuploader/carrierwave

8.78k stars 1.65k forks source link

Improve content type detection for .dotx, .ai, and others. #2705

Closed dzhikvas closed 7 months ago

dzhikvas commented 9 months ago

To correctly detect content type of file in some cases file extension should be used in addition to magic detection. Such cases include custom extensions with .zip contents, .dotx / .docx files which have same magic signature, and others.

This approach keeps protection from spoofing intact, which would not be guaranteed if Marcel::MimeType.for were used.

This should also resolve issues described in #2704

mshibuya commented 7 months ago

Amazing work, thank you!