feat(previews): add file signature check before opening files

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>

Author: Altahrim

lib/private/Preview/Bitmap.php

@@ -91,7 +91,7 @@ private function getResizedPreview($tmpPath, $maxX, $maxY) {
 		$bp = new Imagick();
 
 		// Layer 0 contains either the bitmap or a flat representation of all vector layers
-		$bp->readImage($tmpPath . '[0]');
+		$bp->readImage($this->getImagickFormatHint() . ':' . $tmpPath . '[0]');
 
 		$bp = $this->resize($bp, $maxX, $maxY);
 
@@ -100,6 +100,22 @@ private function getResizedPreview($tmpPath, $maxX, $maxY) {
 		return $bp;
 	}
 
+	private function isMagicStringSupported(string $filepath): bool {
+		$signatures = $this->getMagicStrings();
+		if (empty($signatures)) {
+			return true;
+		}
+		$length = array_reduce($signatures, static fn (int $carry, string $signature) => max($carry, strlen($signature)), 0);
+		$firstBytes = file_get_contents($filepath, false, null, 0, $length);
+		foreach ($signatures as $signature) {
+			if (str_starts_with($firstBytes, $signature)) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * Returns a resized \Imagick object
 	 *

lib/private/Preview/HEIC.php

@@ -113,7 +113,7 @@ private function getResizedPreview($tmpPath, $maxX, $maxY) {
 		$bp = new \Imagick();
 
 		// Layer 0 contains either the bitmap or a flat representation of all vector layers
-		$bp->readImage($tmpPath . '[0]');
+		$bp->readImage('heic:' . $tmpPath . '[0]');
 
 		// Fix orientation from EXIF
 		$bp->autoOrient();

lib/private/Preview/SGI.php

@@ -30,4 +30,12 @@ class SGI extends Bitmap {
 	public function getMimeType(): string {
 		return '/image\/sgi/';
 	}
+
+	protected function getMagicStrings(): array {
+		return ["\x01\xDA"];
+	}
+
+	protected function getImagickFormatHint(): string {
+		return 'sgi';
+	}
 }

lib/private/Preview/TGA.php

@@ -30,4 +30,12 @@ class TGA extends Bitmap {
 	public function getMimeType(): string {
 		return '/image\/t(ar)?ga/';
 	}
+
+	protected function getMagicStrings(): array {
+		return [];
+	}
+
+	protected function getImagickFormatHint(): string {
+		return 'tga';
+	}
 }