From 993bed4923c88593cc6b1186e0d1b9564994a25a Mon Sep 17 00:00:00 2001 From: ritt Date: Mon, 9 Dec 2019 16:48:20 +0100 Subject: [PATCH] Serve SVG files as attachments only to avoid XSS vulnerabilities --- src/elogd.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/elogd.c b/src/elogd.c index 21ee48e3..0b8fc3c6 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -8416,7 +8416,17 @@ void send_file_direct(char *file_name) { if (filetype[i].ext[0]) { if (strncmp(filetype[i].type, "text", 4) == 0) rsprintf("Content-Type: %s;charset=%s\r\n", filetype[i].type, charset); - else + else if (strcmp(filetype[i].ext, ".SVG") == 0) { + rsprintf("Content-Type: %s\r\n", filetype[i].type); + if (strrchr(file_name, '/')) + strlcpy(str, strrchr(file_name, '/')+1, sizeof(str)); + else + strlcpy(str, file_name, sizeof(str)); + if (str[6] == '_' && str[13] == '_') + rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str+14); + else + rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str); + } else rsprintf("Content-Type: %s\r\n", filetype[i].type); } else if (is_ascii(file_name)) rsprintf("Content-Type: text/plain;charset=%s\r\n", charset);