mugit: b8831a7

1 files changed, 2 insertions(+), 0 deletions(-)

fix: add Content-Disposition & X-Content-Type-Options to prevent SVG XSS

Author: Oleksandr Smirnov olexsmir@gmail.com

Committed at: 2026-06-25 21:31:37 +0300

Authored at: 2026-06-25 21:02:31 +0300

Change ID: zqkvuysltyloppmyvyymrrwksuzuumls

Parent: 58c5b75

M internal/handlers/repo.go

···
        254
        254
         	}

      
        255
        255
         

      
        256
        256
         	w.Header().Set("Content-Type", fc.Mime)

      
        
        257
        +	w.Header().Set("Content-Disposition", "attachment")

      
        
        258
        +	w.Header().Set("X-Content-Type-Options", "nosniff")

      
        257
        259
         	w.WriteHeader(http.StatusOK)

      
        258
        260
         	_, _ = w.Write(fc.Content)

      
        259
        261
         }