Mercurial > hg
comparison mercurial/hgweb/webcommands.py @ 15004:d06b9c55ddab stable
hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923)
Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.
Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:
https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors
author | Matt Mackall <mpm@selenic.com> |
---|---|
date | Sun, 31 Jul 2011 01:46:52 +0200 |
parents | 0cc66f13bea0 |
children | a84698badf0b |
comparison
equal
deleted
inserted
replaced
15001:dd74cd1e5d49 | 15004:d06b9c55ddab |
---|---|
30 return filelog(web, req, tmpl) | 30 return filelog(web, req, tmpl) |
31 else: | 31 else: |
32 return changelog(web, req, tmpl) | 32 return changelog(web, req, tmpl) |
33 | 33 |
34 def rawfile(web, req, tmpl): | 34 def rawfile(web, req, tmpl): |
35 guessmime = web.configbool('web', 'guessmime', False) | |
36 | |
35 path = webutil.cleanpath(web.repo, req.form.get('file', [''])[0]) | 37 path = webutil.cleanpath(web.repo, req.form.get('file', [''])[0]) |
36 if not path: | 38 if not path: |
37 content = manifest(web, req, tmpl) | 39 content = manifest(web, req, tmpl) |
38 req.respond(HTTP_OK, web.ctype) | 40 req.respond(HTTP_OK, web.ctype) |
39 return content | 41 return content |
48 except ErrorResponse: | 50 except ErrorResponse: |
49 raise inst | 51 raise inst |
50 | 52 |
51 path = fctx.path() | 53 path = fctx.path() |
52 text = fctx.data() | 54 text = fctx.data() |
53 mt = mimetypes.guess_type(path)[0] | 55 mt = 'application/binary' |
54 if mt is None: | 56 if guessmime: |
55 mt = binary(text) and 'application/octet-stream' or 'text/plain' | 57 mt = mimetypes.guess_type(path)[0] |
58 if mt is None: | |
59 mt = binary(text) and 'application/binary' or 'text/plain' | |
56 if mt.startswith('text/'): | 60 if mt.startswith('text/'): |
57 mt += '; charset="%s"' % encoding.encoding | 61 mt += '; charset="%s"' % encoding.encoding |
58 | 62 |
59 req.respond(HTTP_OK, mt, path, len(text)) | 63 req.respond(HTTP_OK, mt, path, len(text)) |
60 return [text] | 64 return [text] |