PHP 5.3.5 fileinfo() MIME Type for MS Office 2007 files - magic.mime updates?

Question

On a PHP upload, I'm trying to validate the MIME Type of the files being uploaded to match a valid set of MIME types for the application. When attempting to use the fileinfo() to determine the MIME type of an Office 2007 file it is NOT detecting as their appropriate MIME Types. Instead the MIME type response is "application/zip"

Office Document MIME types: http://filext.com/faq/office_mime_types.php

Example PHP Code:

$oFileInfo = new finfo( FILEINFO_MIME_TYPE );

$sMimeType = $oFileInfo -> file( $_FILES['Filedata']['tmp_name'] );

echo $sMimeType;

Server Setup Info:

• OS: Windows Server 2003 32-bit
• Webserver: IIS 6.0
• PHP: 5.3.5 (Thread Safe) using FastCGI 1.5
• File: magic.mime
  • Example by darko at uvcms dot com 16-Apr-2008 09:35
    • Link: php.net/manual/en/fileinfo.installation.php
  • Size: 517 KB
  • Source: Source Forge: GNU32 - FileType gnuwin32.sourceforge.net/packages/filetype.htm

I've found numerous posts which refer to issues with the newer Office format when downloading from a webserver. In all these examples I haven't found anywhere that illustrates a manor of adding the new MIME types to an existing magic.mime file, or a link to a magic.mime file that already contains the Microsoft Office 2007+ MIME types. Thanks for your assistance.

Answer 1

Newer Office files are actually ZIP archives. That's why MIME Magic database is detecting them as ZIP files. You may need to add special rules based on file extension, or look into the ZIP file to see if it has a docProps folder (Office ZIP archives have such a folder containing meta data about the document).

There are other file formats which are actually ZIP archives with a different extension, e.g. JAR files.

Answer 2

1. Yes, you should update magic.mime.

lol, yeah, just update it, problem solved. Unfortunately, it looks like the magic mime type systems works off of looking at the actual file contents, and because the file is compressed, it can't uncompress (and look at which file?)

someone suggested writing a function to unzip compressed files and then checking for the existence of a "DocProps" directory, for instance. But this would introduce another vector of attack to the production server.

Answer 3

Have you tried to add the new mime types to IIS ?

1. Get to the Internet Management snap-in
2. Right click “Web Sites” and select “Properties”
3. Select “HTTP Headers”
4. Select “Mime Types”
5. Enter a new extension with no leading period and the appropriate mime type. Repeat as needed for each extension.
6. Click “OK” to close all the dialogs

Answer 4

1. Yes, you should update magic.mime.
2. Thumb up for not believing mime type sent from browser ($_FILES['Filedata']['type'])
3. Why you are using a function that the manual said it's deprecated? http://php.net/manual/en/function.mime-content-type.php

Note: finfo() determine the MIME type of a file by it's magic bytes; given the fact that Office 2007 files (and many other file formats, e.g. ePUB) are simply zip packages with specified directory structure, it's reasonable to have finfo() to return application/zip.

I would suggest unzip or list the content to inspect it's structure, if you really want to determinate the file type based on it's content (and not the MIME type browser reports when uploading)