fix: prevent customer uploads for non file based metadata types

Author: SamJUK

app/code/Magento/Customer/Model/FileUploader.php

@@ -49,6 +49,11 @@ class FileUploader
      */
     private $scope;
 
+    /**
+     * @var string[]
+     */
+    private array $validInputTypes;
+
     /**
      * @param CustomerMetadataInterface $customerMetadataService
      * @param AddressMetadataInterface $addressMetadataService
@@ -57,6 +62,7 @@ class FileUploader
      * @param AttributeMetadataInterface $attributeMetadata
      * @param string $entityTypeCode
      * @param string $scope
+     * @param array|null $validInputTypes
      */
     public function __construct(
         CustomerMetadataInterface $customerMetadataService,
@@ -65,7 +71,8 @@ public function __construct(
         FileProcessorFactory $fileProcessorFactory,
         AttributeMetadataInterface $attributeMetadata,
         $entityTypeCode,
-        $scope
+        $scope,
+        ?array $validInputTypes = ['file', 'image']
     ) {
         $this->customerMetadataService = $customerMetadataService;
         $this->addressMetadataService = $addressMetadataService;
@@ -74,6 +81,7 @@ public function __construct(
         $this->attributeMetadata = $attributeMetadata;
         $this->entityTypeCode = $entityTypeCode;
         $this->scope = $scope;
+        $this->validInputTypes = $validInputTypes;
     }
 
     /**
@@ -83,7 +91,7 @@ public function __construct(
      */
     public function validate()
     {
-        if (!in_array($this->attributeMetadata->getFrontendInput(), ['file', 'image'])) {
+        if (!in_array($this->attributeMetadata->getFrontendInput(), $this->validInputTypes)) {
             return [
                 __('"%1" is not a valid input to accept file uploads.', $this->attributeMetadata->getFrontendInput())
             ];

app/code/Magento/Customer/etc/di.xml

@@ -593,4 +593,12 @@
                 type="Magento\Customer\Plugin\AsyncRequestCustomerGroupAuthorization"
         />
     </type>
+    <type name="Magento\Customer\Model\FileUploader">
+        <arguments>
+            <argument name="validInputTypes" xsi:type="array">
+                <item name="file" xsi:type="string">file</item>
+                <item name="image" xsi:type="string">image</item>
+            </argument>
+        </arguments>
+    </type>
 </config>