usememos/memos
1
1
Fork 0
mirror of https://github.com/usememos/memos.git synced 2025-11-08 08:21:49 +08:00
Code Issues Projects Releases Packages Wiki Activity

fix: prevent XSS for specific content types

Browse source
This commit is contained in:
Steven 2025-05-22 00:05:33 +08:00
parent c2528c57f0
commit 46d5307d7f
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
server/router/api/v1/resource_service.go
View file

@ -188,6 +188,12 @@ func (s *APIV1Service) GetResourceBinary(ctx context.Context, request *v1pb.GetR
if strings.HasPrefix(contentType, "text/") {
contentType += "; charset=utf-8"
}
// Prevent XSS attacks by serving potentially unsafe files with a content type that prevents script execution.
if strings.EqualFold(contentType, "image/svg+xml") ||
strings.EqualFold(contentType, "text/html") ||
strings.EqualFold(contentType, "application/xhtml+xml") {
contentType = "application/octet-stream"
}
return &httpbody.HttpBody{
ContentType: contentType,