fix(IFilenameValidator): correctly handle case insensitivity

- forbidden names and forbidden base names are case **insensitive**
  so we need to check all lowercase here.
- add test that config value is also read case insensitive.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Author: susnux

lib/private/Files/FilenameValidator.php

@@ -70,7 +70,7 @@ public function getForbiddenExtensions(): array {
 			// Always forbid .part files as they are used internally
 			$forbiddenExtensions[] = '.part';
 
-			$this->forbiddenExtensions = array_values($forbiddenExtensions);
+			$this->forbiddenExtensions = array_values(array_map(mb_strtolower(...), $forbiddenExtensions));
 		}
 		return $this->forbiddenExtensions;
 	}
@@ -127,9 +127,6 @@ public function getForbiddenCharacters(): array {
 		if (empty($this->forbiddenCharacters)) {
 			// Get always forbidden characters
 			$forbiddenCharacters = str_split(\OCP\Constants::FILENAME_INVALID_CHARS);
-			if ($forbiddenCharacters === false) {
-				$forbiddenCharacters = [];
-			}
 
 			// Get admin defined invalid characters
 			$additionalChars = $this->config->getSystemValue('forbidden_filename_characters', []);
@@ -231,7 +228,8 @@ public function isForbidden(string $path): bool {
 		return false;
 	}
 
-	protected function checkForbiddenName($filename): void {
+	protected function checkForbiddenName(string $filename): void {
+		$filename = mb_strtolower($filename);
 		if ($this->isForbidden($filename)) {
 			throw new ReservedWordException($this->l10n->t('"%1$s" is a forbidden file or folder name.', [$filename]));
 		}
@@ -295,6 +293,6 @@ private function getConfigValue(string $key, array $fallback): array {
 			$values = $fallback;
 		}
 
-		return array_map('mb_strtolower', $values);
+		return array_map(mb_strtolower(...), $values);
 	}
 };

tests/lib/Files/FilenameValidatorTest.php

@@ -146,6 +146,10 @@ public function dataValidateFilename(): array {
 				// needed for Windows namespaces
 				'com1.suffix', ['.htaccess'], ['com1'], [], [], ReservedWordException::class
 			],
+			'forbidden basename case insensitive' => [
+				// needed for Windows namespaces
+				'COM1.suffix', ['.htaccess'], ['com1'], [], [], ReservedWordException::class
+			],
 			'forbidden basename for hidden files' => [
 				// needed for Windows namespaces
 				'.thumbs.db', ['.htaccess'], ['.thumbs'], [], [], ReservedWordException::class
@@ -159,6 +163,9 @@ public function dataValidateFilename(): array {
 			'invalid extension' => [
 				'a: b.txt', ['.htaccess'], [], ['.txt'], [], InvalidPathException::class
 			],
+			'invalid extension case insensitive' => [
+				'a: b.TXT', ['.htaccess'], [], ['.txt'], [], InvalidPathException::class
+			],
 			'empty filename' => [
 				'', [], [], [], [], EmptyFileNameException::class
 			],
@@ -199,7 +206,6 @@ public function data4ByteUnicode(): array {
 		return [
 			['plane 1 𐪅'],
 			['emoji 😶‍🌫️'],
-
 		];
 	}
 
@@ -284,4 +290,30 @@ public function dataIsForbidden(): array {
 			],
 		];
 	}
+
+	/**
+	 * @dataProvider dataGetForbiddenExtensions
+	 */
+	public function testGetForbiddenExtensions($configValue, $expectedValue): void {
+		$validator = new FilenameValidator($this->l10n, $this->database, $this->config, $this->logger);
+		$this->config
+			// only once - then cached
+			->expects(self::once())
+			->method('getSystemValue')
+			->with('forbidden_filename_extensions', ['.filepart'])
+			->willReturn($configValue);
+
+		self::assertEqualsCanonicalizing($expectedValue, $validator->getForbiddenExtensions());
+	}
+
+	public static function dataGetForbiddenExtensions(): array {
+		return [
+			// default
+			[['.filepart'], ['.filepart', '.part']],
+			// always include .part
+			[[], ['.part']],
+			// handle case insensitivity
+			[['.TXT'], ['.txt', '.part']],
+		];
+	}
 }