9dff20e048
* [WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) Add SCRIPT_CAPABLE_MIME_TYPES frozenset (image/svg+xml, text/javascript, application/javascript, text/html, application/xhtml+xml, text/xml, application/xml) and enforce Content-Disposition: attachment on three download endpoints that previously defaulted to inline serving: - GenericAssetEndpoint.get (api/views/asset.py) - StaticFileAssetEndpoint.get (app/views/asset/v2.py) - EntityAssetEndpoint.get (space/views/asset.py) ATTACHMENT_MIME_TYPES is unchanged — users can still upload SVG, JS, and XML files. The fix closes the XSS vector by ensuring script-capable assets are always downloaded rather than rendered in the application's origin. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-7887] fix: normalize MIME type before SCRIPT_CAPABLE_MIME_TYPES check Strip MIME parameters and lowercase before the allowlist check so that stored values like "image/svg+xml; charset=utf-8" or "Image/SVG+XML" are correctly identified as script-capable and served as attachment. Applies to all three download endpoints. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| common.py | ||
| local.py | ||
| openapi.py | ||
| production.py | ||
| redis.py | ||
| storage.py | ||
| test.py | ||