mirror of
https://gitlab.computer.surgery/matrix/grapevine.git
synced 2025-12-16 23:31:24 +01:00
Grapevine is a Matrix homeserver, forked from Conduit 0.7.0
a60501189d
Previously, `Content-Disposition` was always set to `inline`, even for HTML, which means that XSS could be easily acheived by uploading malicious HTML and getting someone to click on the Matrix HTTP API link for that piece of media. Now, we have an allowlist of safe values for `Content-Type` that use `inline` while everything else defaults to `attachment`, including HTML and SVG, which prevents XSS. We also set the `Content-Security-Policy` header because why not. A `set_header_or_panic` function is introduced to do what it says in case Ruma begins providing better or worse values for the relevant headers in the future. The safest way to handle such a case is simply to panic. |
||
|---|---|---|
| bin | ||
| nix | ||
| src | ||
| .envrc | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| Cargo.lock | ||
| Cargo.toml | ||
| clippy.toml | ||
| default.nix | ||
| engage.toml | ||
| flake.lock | ||
| flake.nix | ||
| LICENSE.md | ||
| rust-toolchain.toml | ||
| rustfmt.toml | ||