kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'fix-xss' into 'master'

Browse source 
Fix XSS issue

When view blob as RAW make sure we allow only 2 kind of type: 'text/plain' and 'application/octet-stream'

Fixes #1514

See merge request !1045
This commit is contained in:
Jacob Vosmaer 2014-08-28 15:59:57 +00:00
commit d4180875cb
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/projects/raw_controller.rb
View file

@ -29,12 +29,10 @@ class Projects::RawController < Projects::ApplicationController
private
def get_blob_type
if @blob.mime_type =~ /html|javascript/
if @blob.text?
'text/plain; charset=utf-8'
elsif @blob.name =~ /(?:msi|exe|rar|r0\d|7z|7zip|zip)$/
'application/octet-stream'
else
@blob.mime_type
'application/octet-stream'
end
end
end