Bug 42087

Summary: Add dependency File::LibMagic for validating file using magic numbers
Product: Koha Reporter: David Cook <dcook>
Component: PackagingAssignee: David Cook <dcook>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: mtj
Version: MainKeywords: dependency
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Crowdfunding committed: 0
Crowdfunding contact: Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
This patch adds File::LibMagic to Koha's dependencies via cpanfile. This Perl library allows access to the C library libmagic which determines file type based off of "magic numbers" which are data in the first line of many file types which are unique to that filetype.
Version(s) released in:
Circulation function:
Bug Depends on:    
Bug Blocks: 30033, 42080    
Attachments: Bug 42087: Add dependency to cpanfile
Bug 42087: Add dependency to debian/control

Description David Cook 2026-03-13 02:11:06 UTC
There are many cases in Koha where we're working with files and we want to know what type of file it is, but we can't trust the file extension or the Content-Type that it's uploaded with, because those are user-controlled data.

A common method for testing file type is using magic numbers via the libmagic library. In Perl File::LibMagic provides Perl bindings to this C library, which makes it easy to check what kind of file we're working with (to a reasonable degree).

libfile-libmagic-perl is available in Debian, so it should be an easy dependency to add. 

It will help improve our security and even just user experience.
Comment 1 David Cook 2026-03-13 02:19:16 UTC
Created attachment 195243 [details] [review]
Bug 42087: Add dependency to cpanfile

This change adds File::LibMagic to cpanfile
Comment 2 David Cook 2026-03-13 02:19:19 UTC
Created attachment 195244 [details] [review]
Bug 42087: Add dependency to debian/control

This change adds File::LibMagic (via libfile-libmagic-perl)
to debian/control. The debian/control should be automatically
re-generated by debian/control.in during the package process,
but we want to record the change here anyway.