Language: PHP
Label: safe
CWE: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Code:
    public function uploadImageAction(Request $request)
    {
        $userObj = User::getById($this->getUserId($request));

        if (!$userObj) {
            throw $this->createNotFoundException();
        }

        if ($userObj->isAdmin() && !$this->getAdminUser()->isAdmin()) {
            throw $this->createAccessDeniedHttpException('Only admin users are allowed to modify admin users');
        }

        //Check if uploaded file is an image
        $avatarFile = $request->files->get('Filedata');

        $assetType = Asset::getTypeFromMimeMapping($avatarFile->getMimeType(), $avatarFile);

        if (!$avatarFile instanceof UploadedFile || $assetType !== 'image') {
            throw new \Exception('Unsupported file format.');
        }

        $userObj->setImage($_FILES['Filedata']['tmp_name']);

        // set content-type to text/html, otherwise (when application/json is sent) chrome will complain in
        // Ext.form.Action.Submit and mark the submission as failed

        $response = $this->adminJson(['success' => true]);
        $response->headers->set('Content-Type', 'text/html');

        return $response;
    }