Commit ac24a5a3 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Prevent possible XSS issues by seting text/plain for all text files in

RAW feature
Signed-off-by: default avatarDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
parent a044c4b1
......@@ -29,12 +29,10 @@ class Projects::RawController < Projects::ApplicationController
private
def get_blob_type
if @blob.mime_type =~ /html|javascript/
if @blob.text?
'text/plain; charset=utf-8'
elsif @blob.name =~ /(?:msi|exe|rar|r0\d|7z|7zip|zip)$/
'application/octet-stream'
else
@blob.mime_type
'application/octet-stream'
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment