From 6c1043c5f8289a288affd0e2080864e689fa0f93 Mon Sep 17 00:00:00 2001 From: Seongmin Lee Date: Sun, 17 May 2026 16:48:53 +0900 Subject: [PATCH] appview/repo: fallback to octet-stream for all unsupported media types Fix: Signed-off-by: Seongmin Lee --- appview/repo/blob.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/appview/repo/blob.go b/appview/repo/blob.go index 4c2e4999..6ad4dafd 100644 --- a/appview/repo/blob.go +++ b/appview/repo/blob.go @@ -180,13 +180,13 @@ func (rp *Repo) RepoBlobRaw(w http.ResponseWriter, r *http.Request) { // Serve all textual content as plain text so the browser never // interprets knot-supplied markup or scripts. w.Header().Set("Content-Type", "text/plain; charset=utf-8") - case safeBinaryMIMEType(mediaType) || contentType == "application/octet-stream": + case safeBinaryMIMEType(mediaType): // Use the normalized type, never the raw knot-supplied string. w.Header().Set("Content-Type", mediaType) default: - w.WriteHeader(http.StatusUnsupportedMediaType) - w.Write([]byte("unsupported content type")) - return + // If mediatype is unknown or it's unsafe (e.g. SVG which allows XSS,) + // fallback to octet-stream + w.Header().Set("Content-Type", "application/octet-stream") } if _, err := io.Copy(w, resp.Body); err != nil { l.Error("error streaming knotmirror response", "err", err) -- 2.51.2