fedi/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-11-10 09:09:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable content sniffing on PlainTextBytes (#18359)

Browse source 
- Disable the browser's function to "sniff" for the content-type on the
provided plain text, this will prevent the possible usage of
user-controlled data being sent, which could be malicious.

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Gusted 2022-01-22 18:32:35 +00:00 committed by GitHub
parent 6ad7a5376a
commit 27ee01e1e8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
modules/context/context.go
View file

@ -292,6 +292,7 @@ func (ctx *Context) PlainTextBytes(status int, bs []byte) {
} }
ctx.Resp.WriteHeader(status) ctx.Resp.WriteHeader(status)
ctx.Resp.Header().Set("Content-Type", "text/plain;charset=utf-8") ctx.Resp.Header().Set("Content-Type", "text/plain;charset=utf-8")
ctx.Resp.Header().Set("X-Content-Type-Options", "nosniff")
if _, err := ctx.Resp.Write(bs); err != nil { if _, err := ctx.Resp.Write(bs); err != nil {
log.Error("Write bytes failed: %v", err) log.Error("Write bytes failed: %v", err)
} }