diff options
| author | Matt Selsky <selsky@columbia.edu> | 2012-09-09 20:06:39 +0200 |
|---|---|---|
| committer | Reed Loden <reed@reedloden.com> | 2012-09-09 20:06:39 +0200 |
| commit | 36d868c007f778e72ae31c521595515f428edae0 (patch) | |
| tree | 2850427452ad2fb74a84d822fbdd9501aae6a375 | |
| parent | 721c112eb5133487ec9112c3e94dc5d00061699c (diff) | |
| download | bugzilla-36d868c007f778e72ae31c521595515f428edae0.tar.gz bugzilla-36d868c007f778e72ae31c521595515f428edae0.tar.xz | |
Bug 671612: Send "X-Content-Type-Options: nosniff" with every response
r/a=LpSolit
| -rw-r--r-- | Bugzilla/Attachment/PatchReader.pm | 2 | ||||
| -rw-r--r-- | Bugzilla/CGI.pm | 4 | ||||
| -rwxr-xr-x | attachment.cgi | 3 |
3 files changed, 5 insertions, 4 deletions
diff --git a/Bugzilla/Attachment/PatchReader.pm b/Bugzilla/Attachment/PatchReader.pm index 01a624a8f..cfc7610f4 100644 --- a/Bugzilla/Attachment/PatchReader.pm +++ b/Bugzilla/Attachment/PatchReader.pm @@ -37,7 +37,6 @@ sub process_diff { $last_reader->sends_data_to(new PatchReader::DiffPrinter::raw()); # Actually print out the patch. print $cgi->header(-type => 'text/plain', - -x_content_type_options => "nosniff", -expires => '+3M'); disable_utf8(); $reader->iterate_string('Attachment ' . $attachment->id, $attachment->data); @@ -119,7 +118,6 @@ sub process_interdiff { $last_reader->sends_data_to(new PatchReader::DiffPrinter::raw()); # Actually print out the patch. print $cgi->header(-type => 'text/plain', - -x_content_type_options => "nosniff", -expires => '+3M'); disable_utf8(); } diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm index 7135f7c48..a16ae6686 100644 --- a/Bugzilla/CGI.pm +++ b/Bugzilla/CGI.pm @@ -316,6 +316,10 @@ sub header { unshift(@_, '-x_frame_options' => 'SAMEORIGIN'); } + # Add X-Content-Type-Options header to prevent browsers sniffing + # the MIME type away from the declared Content-Type. + unshift(@_, '-x_content_type_options' => 'nosniff'); + return $self->SUPER::header(@_) || ""; } diff --git a/attachment.cgi b/attachment.cgi index 04bad37b3..64f78dc36 100755 --- a/attachment.cgi +++ b/attachment.cgi @@ -408,8 +408,7 @@ sub view { } print $cgi->header(-type=>"$contenttype; name=\"$filename\"", -content_disposition=> "$disposition; filename=\"$filename\"", - -content_length => $attachment->datasize, - -x_content_type_options => "nosniff"); + -content_length => $attachment->datasize); disable_utf8(); print $attachment->data; } |