0035199: Improvement of the file_get_mime_type() function - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update
0035199	mantisbt	performance	public	2024-12-23 22:53	2025-03-01 18:40

Reporter	raspopov	Assigned To	community
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	2.27.0
Target Version	2.27.1	Fixed in Version	2.27.1

Summary	0035199: Improvement of the file_get_mime_type() function
Description	Profiler can be used not only for acceleration but also to find unusual behaviour of the program. For example, it showed strange behaviour of MantisBT when rendering files, when getting MIME type of files before rendering for css and js. It would seem that the type of such files is predefined and MantisBT should just return it as a constant. But a check showed that this process takes an unexpectedly large amount of CPU time. The `plugin_file_include()` function calls `file_get_mime_type()`, which calls `finfo::file()` with FILEINFO_MIME, which causes the MIME database to be loaded from the file from the disk. For each css and js of plugin, such as the markup plugin enabled by default... And that's odd, especially since MantisBT already has a caching facility for such primitive file types. But this code is called after, not before loading of the MIME database.
Tags	No tags attached.
Attached Files	file_get_mime_type 1 before.png (4,955 bytes) file_get_mime_type 1 before.png (4,955 bytes) file_get_mime_type 2 before.png (5,969 bytes) file_get_mime_type 2 before.png (5,969 bytes)

raspopov 2024-12-23 22:59 reporter ~0069603 Last edited: 2024-12-25 10:30	~~I propose a PR 2062 that simply moves the use of the cache to first place, and only if the file type is not in the cache will the PHP database be used as usual.~~ file_get_mime_type 3 after.png (7,840 bytes) file_get_mime_type 3 after.png (7,840 bytes)

dregad 2024-12-24 09:46 developer ~0069604	Reading 0013193, this has security implications. The override is fine for plugins (which are trusted), but file_get_mime_type() is also used for attachments (= user input), and we need to make sure these can't be served in a way that can cause them to be rendered in the user's browser.

raspopov 2024-12-24 10:33 reporter ~0069605 Last edited: 2024-12-24 22:28	Thanks for the helpful comment. I'm not quite sure how exactly PHP determines the MIME of files with different settings to decide if there was protection or not. I want to test it by myself. But you mean to say, for example, a browser will receive an `exe` file with extension `js` and content type `application/javascript` (detected by extension) will try to execute it as an `exe`? Isn't the opposite dangerous, where javascript is loaded with a jpeg extension and MantisBT detects it as javascript and tells the browser? I temporary removed the PR because I messed up the base branch of PR anyway. :-(

raspopov 2024-12-25 10:27 reporter ~0069608	New PR: 2064. I made that the changes only affect plugin files for now. I also thought that the best optimization of reading files is not to read them at all, so I added a correct ‘Last-Modified’ header and an ‘If-Modified-Since’ handler. I've also updated the array of MIME types. Do I need to add some more popular formats, like "svg"?

dregad 2024-12-26 06:49 developer ~0069611	Re: 0035199:0069605 - To be honest, I have not done a full analysis of this myself, I based my comment on what @dhx wrote in 0013193. I'm not sure we would have an actual vulnerability here, just saying to be careful. assuming the plugins are trusted (from https://github.com/mantisbt/mantisbt/pull/2064#issue-2758860949) Yes we assume that plugins are trusted code. It's the responsibility of the admin installing them that they are not enabling rogue code in their Mantis. I've also updated the array of MIME types. Do I need to add some more popular formats, like "svg"? I think that would make sense, yes.

MantisBT: master-2.27 f5f1c6ad 2024-12-27 20:32 raspopov Committer: community Details Diff	Optimisation of work with plugins files. (0002064) Fix the caching of plugin MIME file types Update common types ($g_plugin_mime_types) used by plugin_file_include() - Replace the old 'text/javascript' with 'application/javascript' - Add modern SVG and WebP image types Performance improvements: - avoid loading the magic database if not needed - Add 'Last-Modified' header and return 304 if unchanged Fixes 0035199, PR https://github.com/mantisbt/mantisbt/pull/2064 Signed-off-by: Damien Regad <dregad@mantisbt.org>		Affected Issues 0035199
	mod - config_defaults_inc.php		Diff File
	mod - core/plugin_api.php		Diff File