Render HTML as text/plain

src/main/scala/gitbucket/core/controller/ControllerBase.scala

@@ -254,7 +254,7 @@ abstract class ControllerBase
     repository: RepositoryService.RepositoryInfo
   ): Unit = {
     JGitUtil.getObjectLoaderFromId(git, objectId) { loader =>
-      contentType = FileUtil.getMimeType(path)
+      contentType = FileUtil.getSafeMimeType(path)
 
       if (loader.isLarge) {
         response.setContentLength(loader.getSize.toInt)

src/main/scala/gitbucket/core/controller/IssuesController.scala

@@ -406,7 +406,7 @@ trait IssuesControllerBase extends ControllerBase {
       case dir if (dir.exists && dir.isDirectory) =>
         dir.listFiles.find(_.getName.startsWith(params("file") + ".")).map { file =>
           response.setHeader("Content-Disposition", f"""inline; filename=${file.getName}""")
-          RawData(FileUtil.getMimeType(file.getName), file)
+          RawData(FileUtil.getSafeMimeType(file.getName), file)
         }
       case _ => None
     }) getOrElse NotFound()

src/main/scala/gitbucket/core/controller/ReleasesController.scala

@@ -79,7 +79,7 @@ trait ReleaseControllerBase extends ControllerBase {
     } yield {
       response.setHeader("Content-Disposition", s"attachment; filename=${asset.label}")
       RawData(
-        FileUtil.getMimeType(asset.label),
+        FileUtil.getSafeMimeType(asset.label),
         new File(getReleaseFilesDir(repository.owner, repository.name), FileUtil.checkFilename(tagName + "/" + fileId))
       )
     }).getOrElse(NotFound())

src/main/scala/gitbucket/core/servlet/PluginAssetsServlet.scala

@@ -26,7 +26,7 @@ class PluginAssetsServlet extends HttpServlet {
         try {
           val bytes = IOUtils.toByteArray(in)
           resp.setContentLength(bytes.length)
-          resp.setContentType(FileUtil.getContentType(path, bytes))
+          resp.setContentType(FileUtil.getMimeType(path, bytes))
           resp.setHeader("Cache-Control", "max-age=3600")
           resp.getOutputStream.write(bytes)
         } finally {

src/main/scala/gitbucket/core/util/FileUtil.scala

@@ -16,7 +16,7 @@ object FileUtil {
       }
     }
 
-  def getContentType(name: String, bytes: Array[Byte]): String = {
+  def getMimeType(name: String, bytes: Array[Byte]): String = {
     defining(getMimeType(name)) { mimeType =>
       if (mimeType == "application/octet-stream" && isText(bytes)) {
         "text/plain"
@@ -26,6 +26,10 @@ object FileUtil {
     }
   }
 
+  def getSafeMimeType(name: String): String = {
+    getMimeType(name).replace("text/html", "text/plain")
+  }
+
   def isImage(name: String): Boolean = getMimeType(name).startsWith("image/")
 
   def isLarge(size: Long): Boolean = (size > 1024 * 1000)