awcodes/filament-curator v3.7.11

on GitHub

Security release

See GHSA-3xm3-q2fj-x8rq for the full advisory.

• Media streamed from disk was typed by sniffing its contents. SVG markup stored under another extension came back as image/svg+xml under an inline disposition and could render as a document in the application's origin. The serving layer now pins Content-Type from the stored extension, forces a download when the extension is unknown and the sniff would render as a document, and sends X-Content-Type-Options: nosniff throughout.
• The curation modal wrote to a client-supplied path. saveCuration() consumed the crop payload unvalidated, so a key such as ../../other could overwrite a sibling file inside the storage disk. The payload is now validated before anything is written.
• curator:sanitize-svgs could never finish on larger libraries. Its two selection criteria were or'd at the top level, so chunkById's and id > ? bound to only one of them and every type-matched row was handed back on each pass. Any library with more than 100 SVG records looped until the command was killed. If a scan appeared to hang on an earlier version, re-run it.

The upload-side half of the advisory does not affect 3.x: its uploader already decided whether to sanitize from the detected type rather than the filename.

After upgrading

php artisan curator:sanitize-svgs --dry-run   # report only
php artisan curator:sanitize-svgs

Reported by Afsana Alijabarova (@afa114).