[4.0] MediaHelper xss_check question

[ceford]

Steps to reproduce the issue

Look at code: libraries/Helper/MediaHelper.php line 300

$xss_check = file_get_contents($file['tmp_name'], false, null, -1, 256);

It makes no sense to me. It reads in the last character so none of the following tag tests can ever find a tag.

If terminated after the file name it can successfully reject a bad svg file.

$xss_check = file_get_contents($file['tmp_name']);//, false, null, -1, 256);

Can someone explain?

Expected result

Actual result

System information (as much as possible)

Additional comments

[bembelimen]

That line is very old (over 12 years, so I assume it was there from the beginning): https://github.com/joomla/joomla-cms/blame/8025827bf07e5b886906b3796cb9ca6e31243011/administrator/components/com_media/helpers/media.php#L118

So probably it is a matter of "it was alway there, so don't touch it". The length limitation could have been for performance reasons on large files. If you have a good validation, feel free to make a PR!