{"thread":{"id":"10931","subject":"[RFC/PATCH] gitweb: Try to sanitize mimetype for 'blob_plain' view","startedAt":"2007-11-19T14:54:14Z","lastAt":"2007-11-20T10:58:04Z","messageCount":3,"participants":["Jakub Narebski","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"60313","messageId":"1195484054-18164-1-git-send-email-jnareb@gmail.com","threadId":"10931","inReplyTo":null,"subject":"[RFC/PATCH] gitweb: Try to sanitize mimetype for 'blob_plain' view","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2007-11-19T14:54:14Z","receivedAt":"2007-11-19T14:54:14Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Use 'text/plain' for files which are text and can be viewed in a\nbrowser, and are not among a few 'text/*' mimetypes universally\nrecognized by web browsers.  This means files with 'text/*' which are\nnot text/html, text/css, text/sgml or text/xml, and files with\n'application/x-*' mimetype which are nevertheless text: javascript,\nshell, Perl, Tcl, (La)TeX,...\n\nSigned-off-by: Jakub Narebski <jnareb@gmail.com>\n---\nTired of my web browser (Mozilla) asking me what I want to do with\nshell script, Perl script or LaTeX document when using 'blob_plain'\n(raw) view, because of declaration in mimetypes file I have added\nmimetype sanitizing to gitweb.\n\nIt is an RFC partially because list of mimetypes is a bit\narbitrary. Additionally I guess that the mimetype sanitizing should be\nseparated into subroutine.\n\nBut most of all beause proper solution is to create mimetype file for\nuse by gitweb.\n\n gitweb/gitweb.perl |   23 ++++++++++++++++++++++-\n 1 files changed, 22 insertions(+), 1 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex 491a3f4..1cfe293 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -2366,7 +2366,28 @@ sub blob_mimetype {\n \n \tif ($filename) {\n \t\tmy $mime = mimetype_guess($filename);\n-\t\t$mime and return $mime;\n+\n+\t\tif ($mime) {\n+\t\t\t# try to sanitize mimetype\n+\n+\t\t\t# return text/plain on unknown text/* mimetype\n+\t\t\tif ($mime =~ m!^text/! &&\n+\t\t\t    $mime !~ m!^text/(?:html|css|sgml|xml)$!) {\n+\t\t\t\treturn 'text/plain' .\n+\t\t\t\t       ($default_text_plain_charset ?\n+\t\t\t\t        '; charset='.$default_text_plain_charset : '');\n+\t\t\t}\n+\t\t\t# return text/plain for known programming languages and like\n+\t\t\tif ($mime =~ m!^application/x-(?:\n+\t\t\t                javascript|csshell|shell|csh|perl|\n+\t\t\t                sh|shar|tcl|latex|tex|texinfo)!x) {\n+\t\t\t\treturn 'text/plain' .\n+\t\t\t\t       ($default_text_plain_charset ?\n+\t\t\t\t        '; charset='.$default_text_plain_charset : '');\n+\t\t\t}\n+\t\t\t# otherwise return mimetype found in mimetypes file(s)\n+\t\t\treturn $mime;\n+\t\t}\n \t}\n \n \t# just in case\n-- \n1.5.3.5\n"},{"id":"60395","messageId":"7vlk8tl4pv.fsf@gitster.siamese.dyndns.org","threadId":"10931","inReplyTo":"1195484054-18164-1-git-send-email-jnareb@gmail.com","subject":"Re: [RFC/PATCH] gitweb: Try to sanitize mimetype for 'blob_plain' view","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2007-11-20T08:07:56Z","receivedAt":"2007-11-20T08:07:56Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jakub Narebski <jnareb@gmail.com> writes:\n\n> Use 'text/plain' for files which are text and can be viewed in a\n> browser, and are not among a few 'text/*' mimetypes universally\n> recognized by web browsers.  This means files with 'text/*' which are\n> not text/html, text/css, text/sgml or text/xml, and files with\n> 'application/x-*' mimetype which are nevertheless text: javascript,\n> shell, Perl, Tcl, (La)TeX,...\n>\n> Signed-off-by: Jakub Narebski <jnareb@gmail.com>\n> ---\n> Tired of my web browser (Mozilla) asking me what I want to do with\n> shell script, Perl script or LaTeX document when using 'blob_plain'\n> (raw) view,...\n\nI admit that I share the irritation, but I've felt that solving\nit this way by discarding information is going backwards, and\nthe kosher solution is to tell the browser what to do with these\nunknown mimetypes.  Unfortunately this needs to be done by the\nuser -- I do not think the server can.\n\nOn the other hand, maybe the people who are browsing the plain\nview from the browser do not need to have the content marked as\nwritten in what programming language.  I dunno.\n"},{"id":"60400","messageId":"200711201158.06029.jnareb@gmail.com","threadId":"10931","inReplyTo":"4BAE81C8-EFF3-473D-B243-B7D0F66F131B@wincent.com","subject":"Re: [RFC/PATCH] gitweb: Try to sanitize mimetype for 'blob_plain' view","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2007-11-20T10:58:04Z","receivedAt":"2007-11-20T10:58:04Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Wincent Colaiuta wrote:\n\n> So yes, this is discarding information -- in a sense it is actually  \n> removing *correct* configuration from the server side to work around  \n> undesired behaviour on the client side -- but it gave the behaviour I  \n> wanted. So I think this patch is actually a good idea, because the  \n> behaviour (the user experience) is more important than adhering to a  \n> standard just because its a standard.\n\nModifying gitweb to work around not configured web browser and \nmime.types not written for gitweb like in this RFC patch is one way of \nsolving this. Is it good way? That is why it is an RFC... well that\nand details of sanitization.\n\nAnother would be to use mime.types crafted specially for gitweb, and use \nit for $mimetypes_file (gitweb falls back to /etc/mime.types if it is \nnot defined or not present). This might be better solution.\n\n\nQUESTION: Currently gitweb checks if $mimetypes_file is relative path \n(using nonportable m!^/! instead of File::Spec::file_name_is_absolute),\nand if it is then it is used as relative to project. Does anyone use \nthis feature to provide per-project mimetypes? Would perhaps using \nrelative path as-is (i.e. relative to gitweb script) be better \nsolution, and checking for gitweb.mimetypes repo configuration variable \nfor per-repo relative to project if relative?\n\n-- \nJakub Narebski\nPoland\n"}]}