fix(security): Force Imagick to only accept HEIC/HEIF images

Signed-off-by: Fabian Zwemke <fabian@zwemke.de>

Author: fabianzw

lib/private/Preview/HEIC.php

@@ -96,11 +96,10 @@ public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
 	private function getResizedPreview($tmpPath, $maxX, $maxY) {
 		$bp = new \Imagick();
 
-		// Some HEIC files just contain (or at least are identified as) other formats
-		// like JPEG. We just need to check if the image is safe to process.
-		$bp->pingImage($tmpPath . '[0]');
+		// Force Imagick to only accept HEIC or HEIF images
+		$bp->pingImage('heic:' . $tmpPath . '[0]');
 		$mimeType = $bp->getImageMimeType();
-		if (!preg_match('/^image\/(x-)?(png|jpeg|gif|bmp|tiff|webp|hei(f|c)|avif)$/', $mimeType)) {
+		if (!preg_match('/^image\/(x-)?hei(f|c)$/', $mimeType)) {
 			throw new \Exception('File mime type does not match the preview provider: ' . $mimeType);
 		}