CVE-2022-1928: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-05-29T14:15Z
Repository: https://github.com/go-gitea/gitea
Language: Go
Files changed: modules/typesniffer/typesniffer.go, routers/common/repo.go
Commit date: 2022-05-28 18:10:14 +0300
Commit message: Fix raw endpoint PDF file headers (#19825)


Diff: diff --git a/modules/typesniffer/typesniffer.go b/modules/typesniffer/typesniffer.go
index e4bed6595a..b6a6646d50 100644
--- a/modules/typesniffer/typesniffer.go
+++ b/modules/typesniffer/typesniffer.go
@@ -15,12 +15,16 @@ import (
 )
 
 // Use at most this many bytes to determine Content Type.
 const sniffLen = 1024
 
-// SvgMimeType MIME type of SVG images.
-const SvgMimeType = "image/svg+xml"
+const (
+	// SvgMimeType MIME type of SVG images.
+	SvgMimeType = "image/svg+xml"
+	// ApplicationOctetStream MIME type of binary files.
+	ApplicationOctetStream = "application/octet-stream"
+)
 
 var (
 	svgTagRegex      = regexp.MustCompile(`(?si)\A\s*(?:(<!--.*?-->|<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg[\s>\/]`)
 	svgTagInXMLRegex = regexp.MustCompile(`(?si)\A<\?xml\b.*?\?>\s*(?:(<!--.*?-->|<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg[\s>\/]`)
 )
diff --git a/routers/common/repo.go b/routers/common/repo.go
index d037e151f9..b3cd749115 100644
--- a/routers/common/repo.go
+++ b/routers/common/repo.go
@@ -86,14 +86,18 @@ func ServeData(ctx *context.Context, name string, size int64, reader io.Reader)
 		if mappedMimeType != "" {
 			ctx.Resp.Header().Set("Content-Type", mappedMimeType)
 		}
 		if (st.IsImage() || st.IsPDF()) && (setting.UI.SVG.Enabled || !st.IsSvgImage()) {
 			ctx.Resp.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, name))
-			if st.IsSvgImage() {
+			if st.IsSvgImage() || st.IsPDF() {
 				ctx.Resp.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
 				ctx.Resp.Header().Set("X-Content-Type-Options", "nosniff")
-				ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)
+				if st.IsSvgImage() {
+					ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)
+				} else {
+					ctx.Resp.Header().Set("Content-Type", typesniffer.ApplicationOctetStream)
+				}
 			}
 		} else {
 			ctx.Resp.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, name))
 		}
 	}

Vulnerable code: // SvgMimeType MIME type of SVG images.
const SvgMimeType = "image/svg+xml"
			if st.IsSvgImage() {
				ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)
Fixed code: const (
	// SvgMimeType MIME type of SVG images.
	SvgMimeType = "image/svg+xml"
	// ApplicationOctetStream MIME type of binary files.
	ApplicationOctetStream = "application/octet-stream"
)
			if st.IsSvgImage() || st.IsPDF() {
				if st.IsSvgImage() {
					ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)
				} else {
					ctx.Resp.Header().Set("Content-Type", typesniffer.ApplicationOctetStream)
				}