Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

@@ -5,14 +5,17 @@ namespace Umbraco.Extensions;
 public static class ContentSettingsExtensions
 {
     /// <summary>
-    ///     Determines if file extension is allowed for upload based on (optional) white list and black list
-    ///     held in settings.
-    ///     Allow upload if extension is whitelisted OR if there is no whitelist and extension is NOT blacklisted.
+    /// Determines if file extension is allowed for upload based on (optional) allow list and deny list held in settings.
+    /// Disallowed file extensions are only considered if there are no allowed file extensions.
     /// </summary>
-    public static bool IsFileAllowedForUpload(this ContentSettings contentSettings, string extension) =>
-        contentSettings.AllowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension)) ||
-        (contentSettings.AllowedUploadedFileExtensions.Any() == false &&
-         contentSettings.DisallowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension)) == false);
+    /// <param name="contentSettings">The content settings.</param>
+    /// <param name="extension">The file extension.</param>
+    /// <returns>
+    ///   <c>true</c> if the file extension is allowed for upload; otherwise, <c>false</c>.
+    /// </returns>
+    public static bool IsFileAllowedForUpload(this ContentSettings contentSettings, string extension)
+        => contentSettings.AllowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension.Trim())) ||
+        (contentSettings.AllowedUploadedFileExtensions.Any() == false && contentSettings.DisallowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension.Trim())) == false);
 
     /// <summary>
     ///     Gets the auto-fill configuration for a specified property alias.

@@ -0,0 +1,76 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+using NUnit.Framework;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Tests.UnitTests.Umbraco.Core.Configuration;
+
+[TestFixture]
+public class ContentSettingsExtensionsTests
+{
+    [TestCase("jpg")]
+    [TestCase("JPG")]
+    [TestCase("jpg ")]
+    public void IsFileAllowedForUpload_Allows_File_In_Allow_List(string extension)
+    {
+        var contentSettings = new ContentSettings
+        {
+            AllowedUploadedFileExtensions = ["jpg", "png"],
+        };
+
+        Assert.IsTrue(contentSettings.IsFileAllowedForUpload(extension));
+    }
+
+    [TestCase("gif")]
+    [TestCase("GIF")]
+    [TestCase("gif ")]
+    public void IsFileAllowedForUpload_Rejects_File_Not_In_Allow_List(string extension)
+    {
+        var contentSettings = new ContentSettings
+        {
+            AllowedUploadedFileExtensions = ["jpg", "png"],
+        };
+
+        Assert.IsFalse(contentSettings.IsFileAllowedForUpload(extension));
+    }
+
+    [TestCase("jpg")]
+    [TestCase("JPG")]
+    [TestCase("jpg ")]
+    public void IsFileAllowedForUpload_Allows_File_Not_In_Disallow_List(string extension)
+    {
+        var contentSettings = new ContentSettings
+        {
+            DisallowedUploadedFileExtensions = ["gif", "png"],
+        };
+
+        Assert.IsTrue(contentSettings.IsFileAllowedForUpload(extension));
+    }
+
+    [TestCase("gif")]
+    [TestCase("GIF")]
+    [TestCase("gif ")]
+    public void IsFileAllowedForUpload_Rejects_File_In_Disallow_List(string extension)
+    {
+        var contentSettings = new ContentSettings
+        {
+            DisallowedUploadedFileExtensions = ["gif", "png"],
+        };
+
+        Assert.IsFalse(contentSettings.IsFileAllowedForUpload(extension));
+    }
+
+    [Test]
+    public void IsFileAllowedForUpload_Allows_File_In_Allow_List_Even_If_Also_In_Disallow_List()
+    {
+        var contentSettings = new ContentSettings
+        {
+            AllowedUploadedFileExtensions = ["jpg", "png"],
+            DisallowedUploadedFileExtensions = ["jpg"],
+        };
+
+        Assert.IsTrue(contentSettings.IsFileAllowedForUpload("jpg"));
+    }
+}