[PATCH] gitweb: Fix usability of $prevent_xss
- From
Jakub Narebski <jnareb@gmail.com>
- Date
- Jun 4, 2011, 08:43 UTC
- Message-ID
- <1307177015-880-1-git-send-email-jnareb@gmail.com>
With XSS prevention on (enabled using $prevent_xss), blobs ('blob_plain') of all types except a few known safe ones are served with "Content-Disposition: attachment". However the check was too strict; it didn't take into account optional parameter attributes,
media-type = type "/" subtype *( ";" parameter )
as described in RFC 2616
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17 http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7
This fixes that, and it for example treats following as safe MIME media type:
text/plain; charset=utf-8
Signed-off-by: Jakub Narebski <jnareb@gmail.com> --- The fact that it this buglet was present for so long, since its introduction by Matt McCutchen in 7e1100e (gitweb: add $prevent_xss option to prevent XSS by repository content, 2009-02-07) without complaint shows that not many people are using this feature...
That, and that we don't have automated tests for that.
gitweb/gitweb.perl | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index dc3f37d..85acbed 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -6139,7 +6139,7 @@ sub git_blob_plain { # want to be sure not to break that by serving the image as an # attachment (though Firefox 3 doesn't seem to care). my $sandbox = $prevent_xss && - $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))$!; + $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))(?:[ ;]|$)!; print $cgi->header( -type => $type,
-- 1.7.5