Image widgets allow to upload unwanted file types (eg PDF, EPS)

Standard image field when using Rokka 3.0.6:

After updating to Rokka 3.0.8:

The regression has been introduced in commit: 5387a5f.

The previous implementation was extending the allowed extensions in RokkaImageFactory::getSupportedExtensions() which was OK since the image factory needs to know which extensions it can handle. This does not affect user facing forms in any way.

In the commit the extensions that are supported by Rokka but not by the default GD2 image library are being injected in user facing forms:

function rokka_field_widget_single_element_form_alter(&$element, FormStateInterface $form_state, $context) {
  // ...
  if ($uri_schema === 'rokka') {
    $default = explode(' ', $element['#upload_validators']['FileExtension']['extensions']);
    $rokka_specific = ['pdf', 'eps', 'webp', 'svg', 'tiff', 'heic'];
    $extensions = array_unique(array_merge($default, $rokka_specific), SORT_REGULAR);
    $element['#upload_validators']['FileExtension']['extensions'] = implode(' ', $extensions);
  }
}

There is no need to append the extensions in this way. The File module already allows the site builder to set the allowed extensions using the Field UI. They can just add PDF or other extensions there.

From a different perspective: the file extensions that can be stored on Rokka should not be controlled on form level, but rather by the image manipulation API. Then they will work correctly also when files are added outside of forms. We should use ImageToolkitInterface::getSupportedExtensions(), as is proposed as part of the fix for #3461471: Fatal error "Stream must be a resource".