handleRaw streamed the attachment blob only behind an isImageMime gate (#221), so non-image attachment pastes fell through to empty row.Content and /raw served 0 bytes. Now the blob streams for ALL attachment mimes, with the sniffed mime passed through serveContentType so active-content types (html, svg, xml) still serve as text/plain per the #34 stored-XSS rule.
Regression tests: text attachment via multipart create then GET /raw asserts 200, text/plain; charset=utf-8, nosniff, byte equality; html attachment asserts the forced text/plain Content-Type with original bytes.
go build + go test ./... pass.
Removed the now-unused isImageMime helper.
Fix attempt 1. Ref #281.
handleRaw streamed the attachment blob only behind an isImageMime gate (#221), so non-image attachment pastes fell through to empty row.Content and /raw served 0 bytes. Now the blob streams for ALL attachment mimes, with the sniffed mime passed through serveContentType so active-content types (html, svg, xml) still serve as text/plain per the #34 stored-XSS rule.
- Regression tests: text attachment via multipart create then GET /raw asserts 200, text/plain; charset=utf-8, nosniff, byte equality; html attachment asserts the forced text/plain Content-Type with original bytes.
- go build + go test ./... pass.
- Removed the now-unused isImageMime helper.
handleRaw only streamed the blob behind an isImageMime gate (#221), so
non-image attachment pastes fell through to empty row.Content and /raw
served 0 bytes. Serve the blob for every attachment mime, passing the
sniffed mime through serveContentType so active-content types (html,
svg, xml) still serve as text/plain per the #34 rule. Regression tests
cover text and html attachments (size, Content-Type, byte equality).
fen
merged commit c190dd9ea6 into dev2026-09-18 01:33:45 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fix attempt 1. Ref #281.
handleRaw streamed the attachment blob only behind an isImageMime gate (#221), so non-image attachment pastes fell through to empty row.Content and /raw served 0 bytes. Now the blob streams for ALL attachment mimes, with the sniffed mime passed through serveContentType so active-content types (html, svg, xml) still serve as text/plain per the #34 stored-XSS rule.