Merge commit from fork

Co-authored-by: Bogdan <matolq@gmail.com>

Author: michalsn

system/HTTP/Files/UploadedFile.php

@@ -123,7 +123,8 @@ public function __construct(string $path, string $originalName, ?string $mimeTyp
      * @see http://php.net/move_uploaded_file
      *
      * @param string      $targetPath Path to which to move the uploaded file.
-     * @param string|null $name       the name to rename the file to.
+     * @param string|null $name       The name to rename the file to. When null, the client-provided name is used and sanitized.
+     *                                A caller-supplied name is NOT sanitized.
      * @param bool        $overwrite  State for indicating whether to overwrite the previously generated file with the same
      *                                name or not.
      *
@@ -142,7 +143,10 @@ public function move(string $targetPath, ?string $name = null, bool $overwrite =
             throw HTTPException::forInvalidFile();
         }
 
-        $name ??= $this->getName();
+        if ($name === null) {
+            helper('security');
+            $name = sanitize_filename($this->getName());
+        }
         $destination = $overwrite ? $targetPath . $name : $this->getDestination($targetPath . $name);
 
         try {

tests/system/HTTP/Files/FileMovingTest.php

@@ -100,6 +100,38 @@ public function testMove(): void
         $this->assertTrue($this->root->hasChild('destination/' . $finalFilename . '_1.txt'));
     }
 
+    public function testMoveSanitizesClientNameByDefault(): void
+    {
+        service('superglobals')->setFilesArray([
+            'userfile' => [
+                'name'     => '../../public/shell.php',
+                'type'     => 'text/plain',
+                'size'     => 124,
+                'tmp_name' => '/tmp/fileA.txt',
+                'error'    => 0,
+            ],
+        ]);
+
+        $collection = new FileCollection();
+
+        $this->assertTrue($collection->hasFile('userfile'));
+
+        $destination = $this->destination;
+        if (! is_dir($destination)) {
+            mkdir($destination, 0777, true);
+        }
+
+        $file = $collection->getFile('userfile');
+        $this->assertInstanceOf(UploadedFile::class, $file);
+
+        // No second argument: the client-provided name must be sanitized.
+        $file->move($destination);
+
+        $this->assertSame('publicshell.php', $file->getName());
+        $this->assertTrue($this->root->hasChild('destination/publicshell.php'));
+        $this->assertFalse($this->root->hasChild('public/shell.php'));
+    }
+
     public function testMoveOverwriting(): void
     {
         $finalFilename = 'file_with_delimiters_underscore';

user_guide_src/source/changelogs/v4.7.4.rst

@@ -30,6 +30,15 @@ SECURITY
   See the `Security advisory GHSA-c9w5-rwh3-7pm9 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9>`_
   for more information.
 
+- **UploadedFile:** ``UploadedFile::move()`` now sanitizes the client-provided
+  filename when called without a second argument. Previously, the unsanitized
+  client filename was used as the default, allowing path traversal sequences
+  (e.g. ``../../public/shell.php``) to write the uploaded file outside the
+  intended directory. A name explicitly passed as the second argument is not
+  sanitized and remains the caller's responsibility.
+  See the `Security advisory GHSA-hhmc-q9hp-r662 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662>`_
+  for more information.
+
 ********
 BREAKING
 ********

user_guide_src/source/libraries/uploaded_files.rst

@@ -339,7 +339,7 @@ the file to as the first parameter:
 
 .. literalinclude:: uploaded_files/016.php
 
-By default, the original filename was used.
+By default, the client-provided filename is sanitized and used.
 
 with New Filename
 -----------------