mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-06 22:09:44 +02:00
424f67f7cb
isInlineContentType is the security boundary that decides whether an uploaded file is served with Content-Disposition: inline (renderable in the document origin) or attachment. The SVG carve-out added in #3023 to block stored-XSS via uploaded .svg only matched the exact literal "image/svg+xml", so callers that supply "IMAGE/SVG+XML", "image/svg+xml; charset=utf-8", or whitespace-padded variants would still see disposition=inline. MIME type matching is case-insensitive per RFC 2045 §5.1 and may carry parameters, so the safe thing is to normalize at the boundary instead of trusting every caller. Today both call sites (S3.Upload and LocalStorage.Serve) happen to feed in the exact literal because the upload handler overrides .svg to "image/svg+xml" before storage sees it, so this is defense-in-depth rather than a live regression. Hardens the helper so any future caller (including one that ever trusts a client-supplied Content-Type) stays behind the same guard. Co-authored-by: multica-agent <github@multica.ai>
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
package storage
|
|
|
|
import "testing"
|
|
|
|
func TestIsInlineContentType(t *testing.T) {
|
|
cases := []struct {
|
|
ct string
|
|
want bool
|
|
}{
|
|
{"image/png", true},
|
|
{"image/jpeg", true},
|
|
{"image/gif", true},
|
|
{"image/webp", true},
|
|
{"video/mp4", true},
|
|
{"audio/mpeg", true},
|
|
{"application/pdf", true},
|
|
|
|
// SVG must NOT render inline — it can carry executable script.
|
|
{"image/svg+xml", false},
|
|
// MIME types are case-insensitive (RFC 2045 §5.1) and may carry
|
|
// parameters. The SVG carve-out is a security boundary, so any
|
|
// variant that resolves to image/svg+xml must also be blocked.
|
|
{"IMAGE/SVG+XML", false},
|
|
{"Image/Svg+Xml", false},
|
|
{"image/svg+xml; charset=utf-8", false},
|
|
{"image/svg+xml;charset=utf-8", false},
|
|
{" image/svg+xml ", false},
|
|
// Normalization must not break the positive cases either.
|
|
{"IMAGE/PNG", true},
|
|
{"image/png; foo=bar", true},
|
|
{" application/pdf", true},
|
|
|
|
{"text/html", false},
|
|
{"application/octet-stream", false},
|
|
{"text/plain", false},
|
|
{"", false},
|
|
}
|
|
for _, tc := range cases {
|
|
if got := isInlineContentType(tc.ct); got != tc.want {
|
|
t.Errorf("isInlineContentType(%q) = %v, want %v", tc.ct, got, tc.want)
|
|
}
|
|
}
|
|
}
|