From 176afff375040ad56ebe9b930e4f1cd4f762570e Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Mon, 7 Mar 2022 22:50:12 +0000
Subject: [PATCH] Media: Allow `wp_check_filetype()` to support query strings
 in URLs.

This changeset adjusts the regex in `wp_check_filetype()` to support query strings in URLs.

Follow-up to [30640], [32172].

Props voldemortensen, johnbillion, layotte, dd32, atomicjack, supercleanse, spencercameron, ianmjones, audrasjb.
Fixes #30377.


git-svn-id: https://develop.svn.wordpress.org/trunk@52829 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/functions.php                 | 12 +++-
 .../tests/functions/wpCheckFiletype.php       | 58 +++++++++++++++++++
 2 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 tests/phpunit/tests/functions/wpCheckFiletype.php

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 82b19ec8f1..676eacbe38 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -2981,8 +2981,9 @@ function wp_get_default_extension_for_mime_type( $mime_type ) {
  * You can optionally define the mime array, if needed.
  *
  * @since 2.0.4
+ * @since 6.0.0 URLs are now supported.
  *
- * @param string   $filename File name or path.
+ * @param string   $filename File name, path, or URL.
  * @param string[] $mimes    Optional. Array of allowed mime types keyed by their file extension regex.
  * @return array {
  *     Values for the extension and mime type.
@@ -2998,6 +2999,15 @@ function wp_check_filetype( $filename, $mimes = null ) {
 	$type = false;
 	$ext  = false;
 
+	// Strip query args and fragment from filename to reveal extension.
+	$query_pos = strpos( $filename, '?' );
+
+	if ( false !== $query_pos ) {
+		$filename = substr_replace( $filename, '', $query_pos );
+	}
+
+	$filename = strip_fragment_from_url( $filename );
+
 	foreach ( $mimes as $ext_preg => $mime_match ) {
 		$ext_preg = '!\.(' . $ext_preg . ')$!i';
 		if ( preg_match( $ext_preg, $filename, $ext_matches ) ) {
diff --git a/tests/phpunit/tests/functions/wpCheckFiletype.php b/tests/phpunit/tests/functions/wpCheckFiletype.php
new file mode 100644
index 0000000000..d479c6e9a0
--- /dev/null
+++ b/tests/phpunit/tests/functions/wpCheckFiletype.php
@@ -0,0 +1,58 @@
+<?php
+
+/**
+ * Tests for wp_check_filetype()
+ *
+ * @group functions.php
+ * @covers ::wp_check_filetype
+ */
+class Tests_Functions_wpCheckFiletype extends WP_UnitTestCase {
+
+	public function data_url_filetypes() {
+		return array(
+			// Invalid or empty data:
+			array( null, false ),
+			array( '', false ),
+			array( ' ', false ),
+
+			// Paths:
+			array( 'file.jpg', 'jpg' ),
+			array( 'C:\path\to\file.mp3', 'mp3' ),
+			array( 'C:\path\to\file.mp3?file.jpg', 'mp3' ),
+			array( 'C:\path\to\file.exe?file.jpg', false ),
+			array( '/file.jpg', 'jpg' ),
+			array( '/path/to/file.jpg', 'jpg' ),
+			array( '/path/to/file.jpg', 'jpg' ),
+			array( '/file.exe?file.jpg', false ),
+
+			// Absolute URLs:
+			array( 'http://example.com', false ),
+			array( 'http://example.com/', false ),
+			array( 'http://example.com/wibble', false ),
+			array( 'http://example.com/wibble/', false ),
+			array( 'http://example.com/wibble.wobble', false ),
+			array( 'http://example.com/wibble.mp3', 'mp3' ),
+			array( 'http://example.com/wibble.mp3#wobble', 'mp3' ),
+			array( 'http://example.com/wibble.mp3?wobble=true', 'mp3' ),
+			array( 'http://example.com/wibble.mp3?wobble=true#wobble', 'mp3' ),
+			array( 'http://example.mp3/', false ),
+			array( 'http://example.com/file.mp3#file.jpg', 'mp3' ),
+			array( 'http://example.com/file.mp3?file.jpg', 'mp3' ),
+			array( 'http://example.com/file.exe#file.jpg', false ),
+			array( 'http://example.com/file.exe?file.jpg', false ),
+			array( 'http://example.com/file.mp3?foo=bar#?file=file.jpg', 'mp3' ),
+			array( 'http://example.com?file.jpg', false ),
+		);
+	}
+
+	/**
+	 * @dataProvider data_url_filetypes
+	 *
+	 * @param string       $url
+	 * @param string|false $expected
+	 */
+	public function test_url_ext( $url, $expected ) {
+		$filetype = wp_check_filetype( $url );
+		$this->assertSame( $expected, $filetype['ext'] );
+	}
+}