Laravel验证zip文件内容

Question

I want to accept only file which has ".zip" extension. I added a rule mime-type application/zip to control this. But i dont know its content so i need to check zip file's content to avoid unknown files. How can I safely control the contents of a zip file?

I am using https://github.com/Chumper/Zipper to extract and laravel version is 5.5

public function store(Request $request, User $sharingUser) {
        $rules = [
            'patient_case_id'   => 'required|exists:patient_cases,id',
            'file'              => 'required|mimes:zip,rar',
        ];  
}

Uploaded zip file's content tree like this :

xxxx - MAIN FOLDER

|- aaaa.adf

|- bbbb.adf

|- cccc.adf

|- dddd.adf

|- aaaa.ocx

Folder can has only .adf and .ocx files... But i dont know how many files in folder.

note: it is a RESTful API

Answer 1

I would recommend you use PHP League's ZipArchive Adapter instead.

Create a new validation rule. Set up the rule in the request and then define the logic.

use League\Flysystem\Filesystem;
use League\Flysystem\ZipArchive\ZipArchiveAdapter;

$filesystem = new Filesystem(new ZipArchiveAdapter(getrealpath($value)));

In the passes() method, set the file-system up to read the file. I imagine you may need to figure out the path of the file in temporary storage realpath($value).

Then flesh out the logic for the check. You could loop through the files within like so:

foreach ($filesystem->listContents() as $object) {
    if (!in_array($object['mimetype'], ['mimetype1', 'mimetype2'])) {
        return false;
    }

}
return true;

I can't remember if listContents() recursively lists all files, but there may be an option to make it do that, check their documentation. You don't have to use the mimetype comparison, just use whatever makes the most sense.