[13.x] Warn against user-controlled filenames in storeAs and polyglot upload risk

Merged
AS
9d ago
+6-0

Summary

During security research on a Laravel 13 application, we identified documentation gaps that can lead to Remote Code Execution (RCE). This PR adds warnings in three areas:

1. storeAs() / putFileAs() — user-controlled save filename (filesystem.md)

The save filename argument is not validated against dangerous extensions. A developer who passes user input as the save name can allow an attacker to store a file as shell.php. The existing docs show $request->user()->id as an example (safe), but contain no explicit warning.

2. mimes: validation does not prevent PHP execution (validation.md)

A file beginning with GIF or JPEG magic bytes passes mimes:gif / mimes:jpg validation while containing a PHP payload. If the file is then stored with a .php extension and served from a web-accessible directory, it executes as PHP. The docs contain no warning that image validation and PHP-execution prevention are separate concerns.

3. PHAR deserialization via File:: facade and response()->download() (filesystem.md, responses.md)

PHP filesystem functions trigger PHAR archive deserialization when passed a phar:// URI. File::exists(), File::get(), and similar methods call these functions directly without scheme validation. response()->download() and response()->file() are also affected because Symfony's BinaryFileResponse calls is_file() internally when constructing the response.

An attacker who can upload a GIF+PHAR polyglot file and then influence a path argument passed to any of these methods can execute arbitrary code through gadget chains already present in the vendor directory. The file never needs a .php extension and the web server never needs to execute it directly.

Note: Storage:: (Flysystem-backed) does not have this issue because its path normalizer incidentally mangles phar:// URIs, but this is not documented or guaranteed.

Files changed

  • filesystem.md: warning on storeAs/putFileAs save filename; warning on File:: facade PHAR deserialization
  • validation.md: warning on mimes: validation not preventing PHP execution
  • responses.md: warning on response()->download() and response()->file() PHAR deserialization

Test plan

  • Confirm WARNING blocks render correctly in the docs site
  • Confirm no existing content is removed or altered