From c29af83ce1f14b8b2f25b54c3e003ea2ef74ff7a Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 16 Mar 2026 00:05:45 +0000 Subject: [PATCH] Bug 42080: (follow-up) limit data sent to libmagic to 100 characters By limiting the data sent to libmagic to 100 characters, we make the test faster and we avoid situations where a large or malicious file causes too many resources to be used. 100 characters is more than enough for the file types we're allowing. --- acqui/invoice-files.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl index 6886642d853..090f90e85fa 100755 --- a/acqui/invoice-files.pl +++ b/acqui/invoice-files.pl @@ -70,7 +70,8 @@ if ( $op eq 'download' ) { my $ftype = $file->{'file_type'}; my $magic = File::LibMagic->new(); - my $magic_info = $magic->info_from_string( $file->{'file_content'} ); + my $test_str = substr( $file->{'file_content'}, 0, 99 ); + my $magic_info = $magic->info_from_string( \$test_str ); my $magic_mime_type = $magic_info->{mime_type}; if ( $input->param('view') && ( $magic_mime_type && $allowed_ftypes->{$magic_mime_type} ) ) { print $input->header( -- 2.39.5