<?php
declare(strict_types=1);

namespace Autogedal\Extend\Plugin\Security;

use Magento\Framework\Api\ImageProcessor;
use Magento\Framework\Api\Uploader;

/**
 * Restricts allowed upload extensions in ImageProcessor (PolyShell / APSB25-94)
 */
class ImageProcessorPlugin
{
    private const ALLOWED_EXTENSIONS = ['jpg', 'jpeg', 'gif', 'png'];

    private Uploader $uploader;

    public function __construct(Uploader $uploader)
    {
        $this->uploader = $uploader;
    }

    public function beforeProcessImageContent(
        ImageProcessor $subject,
        $entityType,
        $imageContent
    ) {
        $this->uploader->setAllowedExtensions(self::ALLOWED_EXTENSIONS);
        return null;
    }
}