Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
Do not allow Go standard lib to sniff Content-Type header
Matthew Holt committed
Jun 7, 2019 at 19:59 UTC
ef5f29cfb257c7503763a4b16947c4eb6a7864c3
2 files changed
+9
-1
modules/caddyhttp/fileserver/staticfiles.go
+4
-1
@@ -185,7 +185,10 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) error
185
186
// TODO: Etag
187
188
- // TODO: Disable content-type sniffing by setting a content-type...
188
+ // do not allow Go to sniff the content-type
189
+ if w.Header().Get("Content-Type") == "" {
190
+ w.Header()["Content-Type"] = nil
191
+ }
192
193
// let the standard library do what it does best; note, however,
194
// that errors generated by ServeContent are written immediately
modules/caddyhttp/staticresp.go
+5
@@ -39,6 +39,11 @@ func (s Static) ServeHTTP(w http.ResponseWriter, r *http.Request) error {
39
w.Header()[field] = vals
40
}
41
42
+ // do not allow Go to sniff the content-type
43
+ if w.Header().Get("Content-Type") == "" {
44
+ w.Header()["Content-Type"] = nil
45
+ }
46
+
47
// get the status code
48
statusCode := s.StatusCode
49
if statusCode == 0 && s.StatusCodeStr != "" {