Be more strict when checking if mimetype is allowed inline. (#1724)

* Be more strict when checking if mimetype is allowed to be displayed inline.

This takes over some code from zopefoundation/Zope#1167.
See also plone/plone.namedfile#154

* Copy a test for extract_media_type from Zope.

* Rename extract_media_type to _extract_media_type to signal it as private.

news/1167.bugfix

@@ -0,0 +1,2 @@
+Be more strict when checking if mimetype is allowed to be displayed inline.
+[maurits]

src/plone/restapi/services/users/get.py

@@ -27,6 +27,31 @@
 
 DEFAULT_SEARCH_RESULTS_LIMIT = 25
 
+try:
+    # Zope 5.8.4+
+    from OFS.Image import extract_media_type as _extract_media_type
+except ImportError:
+    try:
+        from plone.namedfile.utils import extract_media_type as _extract_media_type
+    except ImportError:
+        # Note that we start the method with an underscore, to signal that this
+        # is a private implementation detail and no one should be importing this.
+
+        def _extract_media_type(content_type):
+            """extract the proper media type from *content_type*.
+
+            Ignore parameters and whitespace and normalize to lower case.
+            See https://github.com/zopefoundation/Zope/pull/1167
+            """
+            if not content_type:
+                return content_type
+            # ignore parameters
+            content_type = content_type.split(";", 1)[0]
+            # ignore whitespace
+            content_type = "".join(content_type.split())
+            # normalize to lowercase
+            return content_type.lower()
+
 
 def getPortraitUrl(user):
     if not user:
@@ -84,7 +109,6 @@ def _sort_users(users: Iterable[MemberData]) -> Sequence[MemberData]:
     def _principal_search_results(
         self, search_for_principal, get_principal_by_id, principal_type, id_key
     ):
-
         hunter = getMultiAdapter((self.context, self.request), name="pas_search")
 
         principals = []
@@ -209,7 +233,6 @@ def reply(self):
         if self.has_permission_to_access_user_info() or (
             current_user_id and current_user_id == self._get_user_id
         ):
-
             # we retrieve the user on the user id not the username
             user = self._get_user(self._get_user_id)
             if not user:
@@ -251,7 +274,7 @@ def _get_user_id(self):
 
     def _should_force_download(self, portrait):
         # If this returns True, the caller should set the Content-Disposition header.
-        mimetype = portrait.content_type
+        mimetype = _extract_media_type(portrait.content_type)
         if not mimetype:
             return False
         if self.use_denylist:

src/plone/restapi/tests/test_services_users.py

@@ -23,6 +23,17 @@
 import unittest
 
 
+class TestUnit(unittest.TestCase):
+    def test_extract_media_type(self):
+        from plone.restapi.services.users.get import _extract_media_type as extract
+
+        self.assertIsNone(extract(None))
+        self.assertEqual(extract("text/plain"), "text/plain")
+        self.assertEqual(extract("TEXT/PLAIN"), "text/plain")
+        self.assertEqual(extract("text / plain"), "text/plain")
+        self.assertEqual(extract(" text/plain ; charset=utf-8"), "text/plain")
+
+
 class TestUsersEndpoint(unittest.TestCase):
 
     layer = PLONE_RESTAPI_DX_FUNCTIONAL_TESTING