From 6f154c07c8d1d479e2b7a2b69c91dd12362fa918 Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Thu, 28 Aug 2014 10:42:52 +0300 Subject: [PATCH] Prevent possible XSS issues by seting text/plain for all text files in RAW feature Signed-off-by: Dmitriy Zaporozhets --- app/controllers/projects/raw_controller.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb index a6b7ae3f127..5ec9c576a66 100644 --- a/app/controllers/projects/raw_controller.rb +++ b/app/controllers/projects/raw_controller.rb @@ -29,12 +29,10 @@ class Projects::RawController < Projects::ApplicationController private def get_blob_type - if @blob.mime_type =~ /html|javascript/ + if @blob.text? 'text/plain; charset=utf-8' - elsif @blob.name =~ /(?:msi|exe|rar|r0\d|7z|7zip|zip)$/ - 'application/octet-stream' else - @blob.mime_type + 'application/octet-stream' end end end