MIME Guard

Stop trusting file extensions. Validate what's actually inside.

The problem

A .jpg file can contain PHP code. A .png can be a ZIP archive. File extensions are trivial to fake, and Statamic doesn't inspect file contents by default. One malicious upload is all it takes.

MIME Guard reads the actual file bytes to determine what a file really is, then enforces your rules.

Features

• Real MIME detection -- uses magic bytes (finfo), not file extensions
• Hierarchical rules -- Global > Container > Blueprint, most specific wins
• Wildcards -- image/*, video/*, document/*, archive/*
• Native CP interface -- tabs, toggle switches, built with Statamic 6 components
• Blocked upload logging -- MIME type, filename, user, and container
• Secure defaults -- SVG, PDF, archives, and binaries blocked out of the box

Installation

composer require arz-cle/mime-guard

Optionally publish the config file:

php artisan vendor:publish --tag=mime-guard-config

Quick start

Via the Control Panel

Navigate to Tools > MIME Guard. Four tabs let you configure everything visually:

Via config file

// config/mime-guard.php
 
return [
    'restricted_by_default' => [
        'application/octet-stream',
        'application/zip',
        'image/svg+xml',
        'application/pdf',
    ],
 
    'containers' => [
        'documents' => [
            'allow' => ['application/pdf'],
        ],
        'gallery' => [
            'allow' => ['image/*'],
            'deny'  => ['image/svg+xml'],
        ],
    ],
 
    'blueprints' => [
        'products::3d_viewer' => [
            'allow' => ['model/stl', 'model/gltf-binary'],
        ],
    ],
 
    'logging' => [
        'enabled' => true,
        'channel' => 'stack',
    ],
];

How rules work

Rules cascade from general to specific. Each level can allow, deny, or inherit: false to start fresh.

Global          Blocks SVG, PDF, ZIP everywhere
  Container     Allows PDF in "documents" container
    Blueprint   Allows STL in "products::3d_viewer" blueprint

A type allowed at a more specific level overrides a global block. A type denied at a more specific level overrides a parent allow.

Wildcards

Requirements

License

MIT -- see LICENSE for details.

Built by Clement Arzoumanian for Statamic.