Skip to content
Snippets Groups Projects
Commit ac24a5a3 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

Prevent possible XSS issues by seting text/plain for all text files in

RAW feature

Signed-off-by: default avatarDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
parent a044c4b1
No related branches found
No related tags found
No related merge requests found
Loading
Loading
@@ -29,12 +29,10 @@ class Projects::RawController < Projects::ApplicationController
private
 
def get_blob_type
if @blob.mime_type =~ /html|javascript/
if @blob.text?
'text/plain; charset=utf-8'
elsif @blob.name =~ /(?:msi|exe|rar|r0\d|7z|7zip|zip)$/
'application/octet-stream'
else
@blob.mime_type
'application/octet-stream'
end
end
end
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment