snoopdave opened a new pull request, #174:
URL: https://github.com/apache/roller/pull/174
This change derives a stored media file's content type from the file itself
rather than from the type declared with the upload, and serves media inline
only
for a small explicit allow-list of passive formats.
## What changed
- Add `MediaTypePolicy` as the single place for the stored type, the inline
allow-list, and the response headers.
- Derive the stored type from the filename; consult the declared type only
for
opaque names and never adopt an active type (an explicit list plus any
`+xml`
suffix).
- Send `X-Content-Type-Options: nosniff` on every media response.
- Serve inline only passive images, audio, video, and PDF; serve everything
else
as `application/octet-stream` with an attachment disposition. SVG is
excluded.
- Route all five upload entry points and the three serving paths through the
policy.
Note for the release notes: media held as CSS or JavaScript now downloads
instead of loading inline — a user-visible compatibility change.
## Tests
`MediaTypePolicyTest` (9 behavioral cases plus 3 source audits asserting
every
caller routes through the policy) covers a file whose declared type does not
match its name, SVG / XHTML and unknown types, genuine images retaining their
type, and `nosniff` on every response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
