PHP文件上传安全：优化代码有效防范漏洞

$file = $_FILES['file'] ?? [];
//检测文件类型
$allow_mime = ['image/jpg', 'image/jpeg', 'image/png', 'image/gif'];
if(! in_array($file['type'], $allow_mime)) {
    echo json_encode(['code' => 1, 'msg' => "文件类型错误"], JSON_UNESCAPED_UNICODE);
    return;
}

print_r($file);

$file = $_FILES['file'] ?? [];
//检测文件类型
$allow_mime = ['image/jpg', 'image/jpeg', 'image/png', 'image/gif'];
if(! in_array((new \finfo(\FILEINFO_MIME_TYPE))->file($file['tmp_name']), $allow_mime)) {
    echo json_encode(['code' => 1, 'msg' => "文件类型错误"], JSON_UNESCAPED_UNICODE);
    return;
}

print_r($file);

$file->getClientMimeType(); //相当于$_FILES['file']['type'];
$file->getMimeType(); //相当于(new \finfo(\FILEINFO_MIME_TYPE))->file($_FILES['file']['tmp_name'])

底层对getClientMimeType()的实现：
是在vendor/symfony/http-foundation/Request.php的createFromGlobals()中，基于$_FILES做的封装。
底层对getMimeType()的实现：
是在vendor/symfony/mime/FileinfoMimeTypeGuesser.php的guessMimeType()中，利用finfo的内置PHP类实现的。

$mime = finfo_file(finfo_open(FILEINFO_MIME_TYPE), $file['tmp_name']);
$mime = (new \finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);

$fileHandle = fopen($_FILES['file']['tmp_name'], 'rb');
$hex = '';
while (! feof($fileHandle)) {
    $byte = fread($fileHandle, 1);
    $hex .= sprintf("%02X ", ord($byte));
}
fclose($fileHandle);
echo $hex;