fix: prevent customer uploads for non file based metadata types

Author: SamJUK

app/code/Magento/Customer/Model/FileUploader.php

@@ -83,6 +83,12 @@ public function __construct(
      */
     public function validate()
     {
+        if (!in_array($this->attributeMetadata->getFrontendInput(), ['file', 'image'])) {
+            return [
+                __('"%1" is not a valid input to accept file uploads.', $this->attributeMetadata->getFrontendInput())
+            ];
+        }
+
         $formElement = $this->elementFactory->create(
             $this->attributeMetadata,
             null,

app/code/Magento/Customer/Test/Unit/Model/FileUploaderTest.php

@@ -16,6 +16,7 @@
 use Magento\Customer\Model\FileUploader;
 use Magento\Customer\Model\Metadata\ElementFactory;
 use Magento\Customer\Model\Metadata\Form\Image;
+use Magento\Customer\Model\Metadata\Form\Select;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 
@@ -118,10 +119,39 @@ public function testValidate()
             ->with($this->attributeMetadata, null, CustomerMetadataInterface::ENTITY_TYPE_CUSTOMER)
             ->willReturn($formElement);
 
+        $this->attributeMetadata->expects($this->once())
+            ->method('getFrontendInput')
+            ->willReturn('image');
+
         $model = $this->getModel(CustomerMetadataInterface::ENTITY_TYPE_CUSTOMER, 'customer');
         $this->assertTrue($model->validate());
     }
 
+    public function testValidateInvalidAttributeType()
+    {
+        $attributeType = 'select';
+        $attributeCode = 'attribute_code';
+        $filename = 'filename.ext1';
+
+        $_FILES = [
+            'customer' => [
+                'name' => [
+                    $attributeCode => $filename,
+                ],
+            ],
+        ];
+
+        $this->attributeMetadata->expects($this->exactly(2))
+            ->method('getFrontendInput')
+            ->willReturn($attributeType);
+
+        $model = $this->getModel(CustomerMetadataInterface::ENTITY_TYPE_CUSTOMER, 'customer');
+        $expectedErrors = [
+            __('"%1" is not a valid input to accept file uploads.', $attributeType)
+        ];
+        $this->assertEquals($expectedErrors, $model->validate());
+    }
+
     public function testUpload()
     {
         $attributeCode = 'attribute_code';