[2.x] fix: stop rejecting uploads over two spellings of the same MIME type

[ekumanov]

Fixes #514.

The problem

getMimeType() cross-validates php-mime-detector against fileinfo and rejects the upload whenever the two answers are not the same string. Most formats have more than one registered name, and the two libraries did not always pick the same one, so a file that is exactly what it claims to be is deleted and the member is shown MIME type mismatch detected: audio/vnd.wave vs audio/x-wav.

.wav is the case that surfaced it — audio/vnd.wave is the IANA registration, audio/x-wav is the name that predates it, and no .wav exists for which the two libraries answer differently, so the format is unavailable on every install. Measuring the rest of the surface (real files wherever a header is not enough; samples fileinfo could not identify at all discarded), 13 of 34 identifiable formats are rejected unconditionally on PHP 8.4 / libmagic 5.45: wav, flac, aiff, m4a, opus, avi, rar v4 and v5, rtf, xml, ttf, ico, deb. Issue #514 has the full table.

The fix

Compare the formats, not the strings.

• EQUIVALENT_MIME_TYPES maps alternative spellings onto one representative each; canonicalMimeType() applies it, after lower-casing and dropping any parameters, so text/XML; charset=utf-8 no longer differs from text/xml. A name that is not in the table is returned unchanged, so anything nobody has listed still has to match exactly.
• The comparison is the only thing that changes. getMimeType() still returns $detectorMime — the detector's own spelling — so the admin's MIME whitelist and the extension mapping see exactly what they saw before.
• The table is a protected const read through static::, so an install with an unusual libmagic build can extend it in a subclass.

Two groupings are wider than pure synonyms, and are commented where they appear:

• Ogg. libmagic names the container (audio/ogg), php-mime-detector the codec inside it (audio/opus). Same bytes, and the container is what an admin whitelisting audio/ogg means.
• SFNT fonts. TrueType and OpenType share the container, and some libmagic builds report font/sfnt for either without distinguishing them. TTF against OTF is not a security boundary.

Why this doesn't weaken the check

Nothing in the table crosses a format boundary, so a file whose magic bytes and whose libmagic signature describe genuinely different formats is still rejected.

I ran every fixture in tests/fixtures through both the current class and the patched one, on Ubuntu 24.04 / libmagic 5.45:

fixture	2.x today	with the fix
Polyglot.flif	REJECTED	REJECTED
Polyglot.jpg	text/html	text/html
SpoofedMime.png	text/html	text/html
TextFileWithPngExtension.png	text/plain	text/plain
Malicious.html	text/html	text/html
Malicious.svg / Safe.svg	image/svg+xml	image/svg+xml
Example.apk	application/vnd.android.package-archive	same
Document.pdf / Example.zip / *.jpg / Plain.txt	unchanged	unchanged

Identical in every row. Polyglot.flif is the one the mismatch branch actually catches, and it still does: image/flif against text/html is a real disagreement. The other malicious fixtures are caught downstream by the whitelist, as they are today.

And the formats that change, same harness:

	2.x today	with the fix
wav	REJECTED	audio/vnd.wave
flac	REJECTED	audio/x-flac
aiff	REJECTED	audio/aiff
m4a	REJECTED	audio/mp4
opus	REJECTED	audio/opus
avi	REJECTED	video/vnd.avi
rar v4 / v5	REJECTED	application/x-rar-compressed
rtf	REJECTED	application/rtf
xml	REJECTED	application/xml
ttf	REJECTED	font/ttf
ico	REJECTED	image/x-icon
deb	REJECTED	application/x-deb

13 formats go from rejected to accepted; none go the other way, and every returned value is the detector's own spelling, unchanged from what the whitelist matched against before.

Tests

Added to tests/unit/Mime/MimeTypeDetectorTest.php:

• a real WAV round-trip, asserting both that it is accepted and that audio/vnd.wave is still what callers get — this one fails on 2.x today;
• a genuine mismatch (FLIF header, HTML body — the shape of the Polyglot.flif fixture) that must still be rejected;
• the equivalence table in both directions, as data providers: 14 pairs of spellings that must merge, 5 pairs of formats that must stay apart, plus pass-through of an unlisted type and of null.

composer test:unit 167/167 green, PHPStan level 6 clean. The two libmagic-dependent tests skip themselves where fileinfo is missing or does not identify a WAV.

No frontend change, so no js/dist.