TYPO3 Core

In my tests, the internal information seems to be inconsistent, e.g. with above example which is a jpg but poses as a .png file:

$mimetype = $currentFileObject->getMimeType();
$extension = $currentFileObject->getExtension();
$absoluteFilePath = Environment::getPublicPath() . '/' . $currentFileObject->getPublicUrl(false);
$type = $currentFileObject->getType();
$isImage = $currentFileObject->isImage();
if ($isImage) {
    $realImageType = \exif_imagetype($absoluteFilePath);
    $this->io->writeln(sprintf('file: extension=%s mimetype=%s, type=%d, real type=%d', extension, mimetype, type, realImageType));
}

result:

file: extension=png, mimetype=image/png, type=2, real type=2

The mimetype is derived from the file extension in FileInfo::getMimeType:

public function getMimeType()
{
    $mimeType = false;
    if ($this->isFile()) {
        $fileExtensionToMimeTypeMapping = $GLOBALS['TYPO3_CONF_VARS']['SYS']['FileInfo']['fileExtensionToMimeType'];
        $lowercaseFileExtension = strtolower($this->getExtension());
        if (!empty($fileExtensionToMimeTypeMapping[$lowercaseFileExtension])) {
            $mimeType = $fileExtensionToMimeTypeMapping[$lowercaseFileExtension];

https://github.com/TYPO3/typo3/blob/main/typo3/sysext/core/Classes/Type/File/FileInfo.php

in addition: Today I detected in a TYPO3 V11 that it is possible to upload files without filename extension, e.g. jpg without .jpg or .jpeg ending

When this (e.g. image) files are used on pages, the affected pages will be broken (Error 503).

My client just stumbled up on this one as well after upgrading from 10.4 to 12.4
And since the mime type is wrongly set, we can't easily spot the error and you have to inspect/download the image etc. Would be great to have this fixed

We use the extension secure_downloads . I did my above tests with the extension installed (I think, not 100% sure). It makes sense to repeat the tests without it and check if / how the result is different.

My gut feeling is what the extension does is not good and we might get different results without it.

Would be great if someone could double-check this or repeat my tests.

secure_downloads overrides the setting:

$GLOBALS['TYPO3_CONF_VARS']['SYS']['FileInfo']['fileExtensionToMimeType'] += \Leuchtfeuer\SecureDownloads\MimeTypes::ADDITIONAL_MIME_TYPES;

TYPO3 explictly does not recommend this, see

typo3/sysext/core/Configuration/DefaultConfiguration.php:

'FileInfo' => [
            // Static mapping for file extensions to mime types.
            // In special cases the mime type is not detected correctly.
            // Use this array only if the automatic detection does not work correct!
            'fileExtensionToMimeType' => [
                'svg' => 'image/svg+xml',
                'youtube' => 'video/youtube',
                'vimeo' => 'video/vimeo',
            ],
        ],

The question is if TYPO3 does "real" detection of mimetime or detects mimetype by using the file extension.

Oh, that is a VERY good hint. secure_downloads is installed as well...

I'll put it on my todo list to check without, but it might take some time :/

I confirm this problem does not occur with TYPO3 v11 without extra extensions and is most likely related to secure_downloads.

Strictly speaking, we should close because it only occurs with not recommended configuration. If someone disagrees and can make a good case, please feel free to reopen.

I performed my tests above (see "Reproduce") by uploading image with "wrong" file ending in TYPO3 system without additional extensions, latest 11.5 branch.

This now is ok:

• preview displayed in file list
• image scaled correctly.

So, it looks like this is related to secure_downloads and specifically overriding the fileExtensionToMimeType as I wrote in my previous comment.

You can also look in the database, this is for my "t3coredev11" - without extensions: (file has .jpg but is png)

select uid,type,extension,mime_type,identifier from sys_file where identifier like '%WRONG_FILE_ENDING%';
+-----+------+-----------+-----------+------------------------------------------------------------------------------+
| uid | type | extension | mime_type | identifier                                                                   |
+-----+------+-----------+-----------+------------------------------------------------------------------------------+
| 253 | 2    | jpg       | image/png | /test/wrong_file_extension/edit_redirect_target_WRONG_FILE_ENDING_IS_PNG.jpg |
+-----+------+-----------+-----------+------------------------------------------------------------------------------+

This is on same machine but different installation v11 with extensions, including secure_downloads:

select uid,type,extension,mime_type,identifier from sys_file where identifier like '%WRONG_FILE_ENDING%';
+---------+------+-----------+------------+-------------------------------------------------------------------------------------+
| uid     | type | extension | mime_type  | identifier                                                                          |
+---------+------+-----------+------------+-------------------------------------------------------------------------------------+
| 1010289 | 2    | jpg       | image/jpeg | /dateien_mit_falscher_dateiendung/edit_redirect_target_WRONG_FILE_ENDING_IS_PNG.jpg |
+---------+------+-----------+------------+-------------------------------------------------------------------------------------+

I added issue for secure_downloads: https://github.com/Leuchtfeuer/typo3-secure-downloads/issues/205

Hi @Sybille Peters ,
confirmed --> the behavior in v12 is exactly the same with and without secure_downloads. Thanks for your investigation!