Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-01-10 01:23:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: disallow inline viewing of unsafe files (#13833)

Browse Source
This commit is contained in:
Shlomo
2025-12-15 20:16:38 +02:00
committed by GitHub
parent 90a151348e
commit 5ae8d553ed
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/middleware/index.js
View File

@@ -273,10 +273,19 @@ middleware.buildSkinAsset = helpers.try(async (req, res, next) => {
middleware.addUploadHeaders = function addUploadHeaders(req, res, next) {
// Trim uploaded files' timestamps when downloading + force download if html
let basename = path.basename(req.path);
const extname = path.extname(req.path);
if (req.path.startsWith('/uploads/files/') && middleware.regexes.timestampedUpload.test(basename)) {
basename = basename.slice(14);
res.header('Content-Disposition', `${extname.startsWith('.htm') ? 'attachment' : 'inline'}; filename="${basename}"`);
const extname = path.extname(req.path).toLowerCase();
const unsafeExtensions = [
'.html', '.htm', '.xhtml', '.mht', '.mhtml', '.stm', '.shtm', '.shtml',
'.svg', '.svgz',
'.xml', '.xsl', '.xslt',
];
const isInlineSafe = !unsafeExtensions.includes(extname);
const dispositionType = isInlineSafe ? 'inline' : 'attachment';
if (req.path.startsWith('/uploads/files/')) {
if (middleware.regexes.timestampedUpload.test(basename)) {
basename = basename.slice(14);
}
res.header('Content-Disposition', `${dispositionType}; filename="${basename}"`);
}
next();