Browse Source

Do not allow Go standard lib to sniff Content-Type header

master
Matthew Holt 6 years ago
parent
commit
ef5f29cfb2
  1. 5
      modules/caddyhttp/fileserver/staticfiles.go
  2. 5
      modules/caddyhttp/staticresp.go

5
modules/caddyhttp/fileserver/staticfiles.go

@ -185,7 +185,10 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) error
// TODO: Etag
// TODO: Disable content-type sniffing by setting a content-type...
// do not allow Go to sniff the content-type
if w.Header().Get("Content-Type") == "" {
w.Header()["Content-Type"] = nil
}
// let the standard library do what it does best; note, however,
// that errors generated by ServeContent are written immediately

5
modules/caddyhttp/staticresp.go

@ -39,6 +39,11 @@ func (s Static) ServeHTTP(w http.ResponseWriter, r *http.Request) error {
w.Header()[field] = vals
}
// do not allow Go to sniff the content-type
if w.Header().Get("Content-Type") == "" {
w.Header()["Content-Type"] = nil
}
// get the status code
statusCode := s.StatusCode
if statusCode == 0 && s.StatusCodeStr != "" {

Loading…
Cancel
Save