Public/elog
1
0
Fork 0
mirror of https://gitea.psi.ch/ELOG/elog.git synced 2026-09-16 21:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Serve SVG files as attachments only to avoid XSS vulnerabilities

Browse Source
This commit is contained in:
ritt 2019-12-09 16:48:20 +01:00
parent eefdabb714
commit 993bed4923
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/elogd.c
View File

@ -8416,7 +8416,17 @@ void send_file_direct(char *file_name) {
if (filetype[i].ext[0]) { if (filetype[i].ext[0]) {
if (strncmp(filetype[i].type, "text", 4) == 0) if (strncmp(filetype[i].type, "text", 4) == 0)
rsprintf("Content-Type: %s;charset=%s\r\n", filetype[i].type, charset); rsprintf("Content-Type: %s;charset=%s\r\n", filetype[i].type, charset);
else else if (strcmp(filetype[i].ext, ".SVG") == 0) {
rsprintf("Content-Type: %s\r\n", filetype[i].type);
if (strrchr(file_name, '/'))
strlcpy(str, strrchr(file_name, '/')+1, sizeof(str));
else
strlcpy(str, file_name, sizeof(str));
if (str[6] == '_' && str[13] == '_')
rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str+14);
else
rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str);
} else
rsprintf("Content-Type: %s\r\n", filetype[i].type); rsprintf("Content-Type: %s\r\n", filetype[i].type);
} else if (is_ascii(file_name)) } else if (is_ascii(file_name))
rsprintf("Content-Type: text/plain;charset=%s\r\n", charset); rsprintf("Content-Type: text/plain;charset=%s\r\n", charset);