xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(image): add X-Content-Type-Options: nosniff to all image responses

Browse Source 
304 与 200 两个分支都附加 nosniff，防止浏览器对 content-type 错配的图片字节
做 MIME sniff（M2）。配合原始文件分支按扩展名决定 content-type 的行为做纵深防御。
This commit is contained in:
xfy 2026-06-18 13:36:39 +08:00
parent 1e2e3c9332
commit 22e883c6d9
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/api/image.rs
View File

@ -206,6 +206,11 @@ fn image_response(
(header::ETAG, HeaderValue::from_str(&etag).unwrap()), (header::ETAG, HeaderValue::from_str(&etag).unwrap()),
(header::CACHE_CONTROL, HeaderValue::from_static(cache_control)), (header::CACHE_CONTROL, HeaderValue::from_static(cache_control)),
(header::CONTENT_TYPE, content_type), (header::CONTENT_TYPE, content_type),
// nosniff 防止浏览器对 content-type 错配的图片字节做 MIME sniff（M2）。
(
header::X_CONTENT_TYPE_OPTIONS,
HeaderValue::from_static("nosniff"),
),
], ],
) )
.into_response(); .into_response();
@ -218,6 +223,10 @@ fn image_response(
(header::CONTENT_TYPE, content_type), (header::CONTENT_TYPE, content_type),
(header::CACHE_CONTROL, HeaderValue::from_static(cache_control)), (header::CACHE_CONTROL, HeaderValue::from_static(cache_control)),
(header::ETAG, HeaderValue::from_str(&etag).unwrap()), (header::ETAG, HeaderValue::from_str(&etag).unwrap()),
(
header::X_CONTENT_TYPE_OPTIONS,
HeaderValue::from_static("nosniff"),
),
], ],
data, data,
) )