Repository: go-gitea/gitea
File: modules/typesniffer/typesniffer.go (Go)

Code before:
	tag := string(data[4:8])
	if tag != "ftyp" {
		return nil, false
	}
	brands = append(brands, string(data[8:12]))
	for i := 16; i+4 <= boxSize; i += 4 {
		brands = append(brands, string(data[i:i+4]))
	}
	return brands, true
}

// DetectContentType extends http.DetectContentType with more content types. Defaults to text/plain if input is empty.
func DetectContentType(data []byte) SniffedType {
	if len(data) == 0 {
		return SniffedType{"text/plain"}
	}

	ct := http.DetectContentType(data)

	if len(data) > SniffContentSize {
		data = data[:SniffContentSize]
	}

	const typeMsFontObject = "application/vnd.ms-fontobject"
	if ct == typeMsFontObject && len(data) > 34 {
		// Stupid Golang blindly detects any content with 34th-35th bytes being "LP" as font, here we try to detect it again by hiding the "LP"
		data = slices.Clone(data)
		data[34] = 'l'
		ct = http.DetectContentType(data)
		if ct == MimeTypeApplicationOctetStream {
			return SniffedType{typeMsFontObject}
		}
	}

	vars := globalVars()
	// SVG is unsupported by http.DetectContentType, https://github.com/golang/go/issues/15888
	detectByHTML := strings.Contains(ct, "text/plain") || strings.Contains(ct, "text/html")
	detectByXML := strings.Contains(ct, "text/xml")
	if detectByHTML || detectByXML {
		dataProcessed := vars.svgComment.ReplaceAll(data, nil)
		dataProcessed = bytes.TrimSpace(dataProcessed)
		if detectByHTML && vars.svgTagRegex.Match(dataProcessed) ||
			detectByXML && vars.svgTagInXMLRegex.Match(dataProcessed) {
			ct = MimeTypeImageSvg
		}
	}

	if strings.HasPrefix(ct, "audio/") && bytes.HasPrefix(data, []byte("ID3")) {
		// The MP3 detection is quite inaccurate, any content with "ID3" prefix will result in "audio/mpeg".
		// So remove the "ID3" prefix and detect again, then if the result is "text", it must be text content.
		// This works especially because audio files contain many unprintable/invalid characters like `0x00`

Review comment (suggestion):
```suggestion
		// Stupid Golang blindly detects any content with 34th-35th bytes being "LP" as font, here we try to detect it again by hiding the "LP"
		// https://github.com/golang/go/issues/77172
```

Add link for reference

Code after:
	tag := string(data[4:8])
	if tag != "ftyp" {
		return nil, false
	}
	brands = append(brands, string(data[8:12]))
	for i := 16; i+4 <= boxSize; i += 4 {
		brands = append(brands, string(data[i:i+4]))
	}
	return brands, true
}

func isEmbeddedOpenType(data []byte) bool {
	// https://www.w3.org/submissions/EOT
	if len(data) < 80 {
		return false
	}
	version := binary.LittleEndian.Uint32(data[8:])  // Actually this standard is abandoned (for IE6-IE11 only), there are only 3 versions defined
	magic := binary.LittleEndian.Uint16(data[34:36]) // MagicNumber: 0x504C ("LP")
	reserved := data[64:80]                          // Reserved 1-4 (each: unsigned long)
	return (version == 0x00010000 || version == 0x00020001 || version == 0x00020002) && magic == 0x504C && bytes.Count(reserved, []byte{0}) == len(reserved)
}

// DetectContentType extends http.DetectContentType with more content types. Defaults to text/plain if input is empty.
func DetectContentType(data []byte) SniffedType {
	if len(data) == 0 {
		return SniffedType{"text/plain"}
	}

	ct := http.DetectContentType(data)

	if len(data) > SniffContentSize {
		data = data[:SniffContentSize]
	}

	const typeMsFontObject = "application/vnd.ms-fontobject"
	if ct == typeMsFontObject {
		// Stupid Golang blindly detects any content with 34th-35th bytes being "LP" as font.
		// If it is not really for ".eot" content, we try to detect it again by hiding the "LP", see the test for more details.
		if isEmbeddedOpenType(data) {
			return SniffedType{typeMsFontObject}
		}
		data = slices.Clone(data)
		data[34] = 'l'
		ct = http.DetectContentType(data)
	}

	vars := globalVars()
	// SVG is unsupported by http.DetectContentType, https://github.com/golang/go/issues/15888
	detectByHTML := strings.Contains(ct, "text/plain") || strings.Contains(ct, "text/html")
	detectByXML := strings.Contains(ct, "text/xml")
	if detectByHTML || detectByXML {