fix(security): disallow file extensions end with html

Author: streamtw

src/LfmUploadValidator.php

@@ -85,6 +85,10 @@ public function extensionIsNotExcutable($excutable_extensions)
             throw new ExcutableFileException();
         }
 
+        if (preg_match('/[a-z]html/', $extension) > 0) {
+            throw new ExcutableFileException();
+        }
+
         return $this;
     }
 

tests/LfmUploadValidatorTest.php

@@ -180,6 +180,18 @@ public function testFailsExtensionIsNotExcutableWithExtensionsStartsWithPhp()
         $validator->extensionIsNotExcutable(['php', 'html']);
     }
 
+    public function testFailsExtensionIsNotExcutableWithExtensionsEndsWithHtml()
+    {
+        $uploaded_file = m::mock(UploadedFile::class);
+        $uploaded_file->shouldReceive('getClientOriginalExtension')->andReturn('dhtml');
+
+        $validator = new LfmUploadValidator($uploaded_file);
+
+        $this->expectException(ExcutableFileException::class);
+
+        $validator->extensionIsNotExcutable();
+    }
+
     public function testFailsExtensionIsValidWithSpecialCharacters()
     {
         $uploaded_file = m::mock(UploadedFile::class);