naxon / laravel-url-uploaded-file Goto Github PK

View Code? Open in Web Editor NEW

17.0 1.0 11.0 12 KB

A package to leverage Laravel's UploadedFile functionality from URLs.

Home Page: https://naxon.dev/blog/upload-files-from-urls-in-laravel

License: MIT License

PHP 100.00%

laravel

laravel-url-uploaded-file's Introduction

Uploade files from URLs in Laravel

This package extends Laravel's UploadedFile functionality using file URLs instead of regular file uploads.

Read the full post in my blog: https://naxon.dev/blog/upload-files-from-urls-in-laravel

Installation

You can install the package via composer:

composer require naxon/laravel-url-uploaded-file

Usage

use Naxon\UrlUploadedFile\UrlUploadedFile;

$file = UrlUploadedFile::createFromUrl('https://naxon.dev/assets/img/portrait.jpg');

Now, because UrlUploadedFile extends UploadedFile, you can store it, get its path and extension and use UploadedFile's functionality with it.

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Roadmap

Version 1.0 provides basic functionality only. It was extracted from a real project I was working on. The plan for version 2.0 is to extend the functionality by adding more downloaders.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

Daniel Naxon
Spatie - On the idea of how to download files.
All Contributors

License

The MIT License (MIT). Please see License File for more information.

laravel-url-uploaded-file's People

Contributors

Stargazers

Watchers

Forkers

nguyenhiepvan wapwn 418sec cuongsql dudubroering les19 jemsk dmitrygaluschkin hamzasgd moatazabdalmageed

laravel-url-uploaded-file's Issues

PHP 8 Compatibility.

I am shifting projects over to use PHP 8 and your library that I use is locked at 7.4. Is it compatible with 8 and if so, can it be upgraded so I don't need to fork?

File is not valid

When you check if the file is valid than i get some error;

$source = UrlUploadedFile::createFromUrl($url);
dump($source->isValid());
dump($source->getErrorMessage());

"The file "" was not uploaded due to an unknown error."

Possible security issue

Hey,

I'm not sure if it's the responsibility of this library, but accepting a URL from user input and handling the resulting file might have some security implications.

For example:

the scheme might be something other than http/https
the scheme might be missing
the URL might point to something like /etc/passwd
the URL might point to some internal URL which you don't want to expose (like the AWS Instance Metadata endpoint)

Do you think checks / validations for the above points should / could be part of this library, or is that outside of its scope / responsibilities?

🚨 Potential Security Vulnerability - huntr.dev

⚠️ Potential Vulnerability in laravel-url-uploaded-file

👋 Hello, @Naxon - @wapwn has disclosed a potential vulnerability in your repository. To validate or invalidate this potential vulnerability, please visit https://huntr.dev/bounties/1-packagist-naxon/laravel-url-uploaded-file and join our community in helping secure open-source code.

☎️ Need further support?

Come and join us on our Discord and a member of our team will be happy to help! 🤗

cc - @JamieSlome

File not valid

When i create a file from url, the file is not valid.

$source = UrlUploadedFile::createFromUrl('https://ny2m44ls0z.b-cdn.net/w_1280,h_720/s3-siris/940a5248-4d5b-4629-a00e-182c1ce4251d.jpg')
dump($source);

Response

Naxon\UrlUploadedFile\UrlUploadedFile {[#1098]()
  -test: false
  -originalName: ""
  -mimeType: "application/octet-stream"
  -error: 0
  #hashName: null
  path: "/tmp"
  filename: "url-file-eh0Tqw"
  basename: "url-file-eh0Tqw"
  pathname: "/tmp/url-file-eh0Tqw"
  extension: ""
  realPath: "/tmp/url-file-eh0Tqw"
  aTime: 2022-03-10 14:30:37
  mTime: 2022-03-10 14:30:37
  cTime: 2022-03-10 14:30:37
  inode: 10228269
  size: 192254
  perms: 0100600
  owner: 33
  group: 1000
  type: "file"
  writable: true
  readable: true
  executable: false
  file: true
  dir: false
  link: false
}

Is there something what i do wrong?