Send .svg files as text/plain to prevent executable JS if they are loaded as SVG in the browser

2016-03-10 09:32:32 +00:00
parent a3383f11a1
commit 89acd36dde
2 changed files with 5 additions and 3 deletions
--- a/test/unit/coffee/ContentTypeMapperTests.coffee
+++ b/test/unit/coffee/ContentTypeMapperTests.coffee
@@ -49,3 +49,7 @@ describe 'ContentTypeMapper', ->
 			it 'should map .jpeg to image/jpeg', ->
 				content_type = @ContentTypeMapper.map('example.jpeg')
 				content_type.should.equal 'image/jpeg'
+				
+			it 'should map .svg to text/plain to protect against XSS (SVG can execute JS)', ->
+				content_type = @ContentTypeMapper.map('example.svg')
+				content_type.should.equal 'text/plain'