Respond with text/plain from /api/proxy and /api/blob #428
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NextResponse (underlying Response) will attempt to auto detect the content type based on the passed blob. With this change the auto detection is disabled and we always return text/plain. It does not change functionality but it adds an extra safegaurd to ensure we never return HTML/JavaScript from the proxy endpoint.
ulrikandersen
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
With this change the /api/proxy endpoint (which allows loading files from external URLs) will always respond
Content-Type: text/plain. This is an extra layer of security (in addition to #417) to safeguard against serving HTML from the proxy endpoint which could be used for an XSS attack.Furthermore the
/api/blobendpoint (which is used for loading files from the repositories) will returntext/plainunless the files in an image, in which case it will returnimage/*. GitHub already returns files in plain text even if they are .html, but we might as well be on the safe side.Motivation and Context
NextResponse (underlying Response) will attempt to auto detect the content type based on the passed blob. With this change the auto detection is disabled and we always set the content type. It does not change functionality but it adds an extra safeguard to ensure we never return HTML/JavaScript from the proxy endpoint.
Types of changes