dmk/mkcleaner

Cleans files by removing any metadata.

v8.0.2 2024-04-26 10:23 UTC

Requires

• php: ^7.2 || ^7.3 || ^7.4
• typo3/cms: ~8.7

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.3
• nimut/testing-framework: ^4.0
• php-parallel-lint/php-parallel-lint: ^1.3
• phpcompatibility/php-compatibility: ^9.3.5
• phpmd/phpmd: ^2.11.1
• phpstan/extension-installer: ^1.1
• phpstan/phpstan: ^1.1
• saschaegerer/phpstan-typo3: ^1.0
• sebastian/phpcpd: ^4.0 || ^5.0 || ^6.0

GPL-2.0-or-later

• Hannes Bochmann

• metadata
• security
• TYPO3 CMS
• cleaner
• mat2

README

What does it do?

This extension cleans files by removing most of the metadata. This is a important step when it comes to security so no sensitive information is leaked. This is done with mat2 (https://0xacab.org/jvoisin/mat2), exiftool (https://exiftool.org/) and qpdf (https://github.com/qpdf/qpdf) in the moment. You need to install/provide those commands on the server CLI. If some command is not available system-wide the path can be configured with $GLOBALS['TYPO3_CONF_VARS']['SYS']['binSetup'] or $GLOBALS['TYPO3_CONF_VARS']['SYS']['binPath'].

Check the logs for errors after uploading files etc.

As soon as everything is setup almost every file that is added/replaced with the TYPO3 FAL API will be cleaned. Furthermore there is a scheduler job that can be used for an initial cleanup of desired folders.

Adding a custom cleaner

A custom cleaner can be added in ext_localconf.php like this:

\DMK\Mkcleaner\Cleaner\Registry::registerCleaner(\Vendor\Package\Cleaner\CustomCleaner::class, 100);

Every cleaner needs to implement DMK\Mkcleaner\Cleaner\CleanerInterface. Please take a look at the existing cleaners.

Drawbacks

Please keep in mind that neither of the tools is perfect and might break files or leave metadata present. For example pdf files sometimes loose all links or svg files have changed content when mat2 would be used. Therefore pdf files are cleaned with exiftool and qpdf instead of mat2 and svg files are omitted completely. Please take care of having svg files without metadata yourself.

Changelog

v8.0.2: add some error handling v8.0.1: resolve symlinks v8.0.0: initial release