You are right, there are no custom mime maps registered (as far as we know). We also agree that MediaWiki does provide a consistent cross-platform experience by using a built-in mime map. However, it is quite unfortunate that this code might contain bugs such as the one linked. We personally feel the benefits of using a specialized library, such as PHP finfo, could outweigh its disadvantages. Still, it is up to the MediaWiki team to balance these arguments and decide which is best.

If you still decide to use the built-in map by default, the documentation should indeed be reviewed and updated.

I chatted with @tstarling who knows the code and its historical context better than me. As I understand it now, the built-in "guess overrides" that come with MediaWiki exist primarily for security, and not so much for correctness. When hosting a public site that permit anyone to upload files that are hosted and served publicly on the web, it's important not to spread potentially dangerous executables. E.g. those hidden in ambiguous file types, or that can may otherwise fool FINFO tooling which are generally not developed with security in mind. E.g. a corrupted file should possibly still report on one's desktop computer as what it most likely is/was, and then let associated handlers (e.g video players or other software), or anti-virus software decide what to do about the corruption.

If security isn't a concern, e.g. on wikis that permit only trusted individuals to edit pages and upload files, or if the wiki is otherwise non-public, one could consider as (temporary) workaround to permit "zip" files and accept that the reported file type may be incorrect.

The order of operations is indeed as intended, and I'll re-purpose this as a documentation task. Office files are unfortunately caught in this but there isn't an obvious alternative that I see here given that they are also true ZIP files and expandable as such.

Proposal:

• Update the wiki page with correct high-level behaviour.
• Write a MimeAnalyzer class comment that describes the library's primary and secondary objectives with regards to security and why it is the way it is.