Mark @ file syntax as deprecated.

The @ is not a completely safe way to send files. If a developer passes
along user data, that user data can include arbitrary files. This is not
desirable, and can go really wrong with URLs.

This also improves content-type and filename detection for local stream
resources.

Refs #6540

src/Network/Http/FormData.php

@@ -87,6 +87,11 @@ class FormData implements Countable
         } elseif (is_resource($value)) {
             $this->_parts[] = $this->addFile($name, $value);
         } elseif (is_string($value) && strlen($value) && $value[0] === '@') {
+            trigger_error(
+                'Using the @ syntax for file uploads is not safe and is deprecated. ' .
+                'Instead you should use file handles.',
+                E_USER_DEPRECATED
+            );
             $this->_parts[] = $this->addFile($name, $value);
         } else {
             $this->_parts[] = $this->newPart($name, $value);
@@ -124,6 +129,12 @@ class FormData implements Countable
         $contentType = 'application/octet-stream';
         if (is_resource($value)) {
             $content = stream_get_contents($value);
+            if (stream_is_local($value)) {
+                $finfo = new \finfo(FILEINFO_MIME);
+                $metadata = stream_get_meta_data($value);
+                $contentType = $finfo->file($metadata['uri']);
+                $filename = basename($metadata['uri']);
+            }
         } else {
             $finfo = new \finfo(FILEINFO_MIME);
             $value = substr($value, 1);

tests/TestCase/Network/Http/FormDataTest.php

@@ -137,6 +137,9 @@ class FormDataTest extends TestCase
      */
     public function testAddArrayWithFile()
     {
+        $errorLevel = error_reporting();
+        error_reporting($errorLevel & ~E_USER_DEPRECATED);
+
         $file = CORE_PATH . 'VERSION.txt';
         $contents = file_get_contents($file);
 
@@ -163,6 +166,8 @@ class FormDataTest extends TestCase
             '',
         ];
         $this->assertEquals(implode("\r\n", $expected), $result);
+
+        error_reporting($errorLevel);
     }
 
     /**
@@ -176,7 +181,7 @@ class FormDataTest extends TestCase
         $contents = file_get_contents($file);
 
         $data = new FormData();
-        $data->add('upload', '@' . $file);
+        $data->add('upload', fopen($file, 'r'));
         $boundary = $data->boundary();
         $result = (string)$data;
 
@@ -213,8 +218,8 @@ class FormDataTest extends TestCase
 
         $expected = [
             '--' . $boundary,
-            'Content-Disposition: form-data; name="upload"',
-            'Content-Type: application/octet-stream',
+            'Content-Disposition: form-data; name="upload"; filename="VERSION.txt"',
+            'Content-Type: text/plain; charset=us-ascii',
             '',
             $contents,
             '--' . $boundary . '--',