From 8f860c9ea6988bd60656797e51be9ac2350207bf Mon Sep 17 00:00:00 2001 From: Florent Date: Thu, 31 Mar 2022 23:39:54 +0200 Subject: [PATCH] [Feature #1300] mime check for bom and comments (#1302) * check for BOM and SVG comments --- v2/go.mod | 1 + v2/internal/frontend/assetserver/mimecache.go | 11 ++++---- .../frontend/assetserver/mimecache_test.go | 28 ++++++++++++++++--- 3 files changed, 31 insertions(+), 9 deletions(-) diff --git a/v2/go.mod b/v2/go.mod index 50889c23..1ff69fbe 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -6,6 +6,7 @@ require ( github.com/Masterminds/semver v1.5.0 github.com/flytam/filenamify v1.0.0 github.com/fsnotify/fsnotify v1.4.9 + github.com/wailsapp/mimetype v1.4.1-beta.1.0.20220331112158-6df7e41671fe github.com/go-git/go-billy/v5 v5.2.0 // indirect github.com/go-git/go-git/v5 v5.3.0 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 diff --git a/v2/internal/frontend/assetserver/mimecache.go b/v2/internal/frontend/assetserver/mimecache.go index 3d224041..dc2dd5c7 100644 --- a/v2/internal/frontend/assetserver/mimecache.go +++ b/v2/internal/frontend/assetserver/mimecache.go @@ -17,12 +17,13 @@ func GetMimetype(filename string, data []byte) string { mutex.Lock() defer mutex.Unlock() - if filepath.Ext(filename) == ".js" { + // short-circuit .js, .css to ensure the + // browser evaluates them in the right context + switch filepath.Ext(filename) { + case ".js": return "application/javascript" - } - - if filepath.Ext(filename) == ".css" { - return "text/css" + case ".css": + return "text/css; charset=utf-8" } result := cache[filename] diff --git a/v2/internal/frontend/assetserver/mimecache_test.go b/v2/internal/frontend/assetserver/mimecache_test.go index d6dbb9df..6b338b7e 100644 --- a/v2/internal/frontend/assetserver/mimecache_test.go +++ b/v2/internal/frontend/assetserver/mimecache_test.go @@ -1,25 +1,45 @@ package assetserver -import "testing" +import ( + "testing" +) func TestGetMimetype(t *testing.T) { type args struct { filename string data []byte } + bomUTF8 := []byte{0xef, 0xbb, 0xbf} + var emptyMsg []byte + css := []byte("body{margin:0;padding:0;background-color:#d579b2}#app{font-family:Avenir,Helvetica,Arial,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;text-align:center;color:#2c3e50;background-color:#ededed}#nav{padding:30px}#nav a{font-weight:700;color:#2c\n3e50}#nav a.router-link-exact-active{color:#42b983}.hello[data-v-4e26ad49]{margin:10px 0}") + html := []byte("title") + bomHtml := append(bomUTF8, html...) + svg := []byte("") + svgWithComment := append([]byte(""), svg...) + svgWithCommentAndControlChars := append([]byte(" \r\n "), svgWithComment...) + svgWithBomCommentAndControlChars := append(bomUTF8, append([]byte(" \r\n "), svgWithComment...)...) + tests := []struct { name string args args want string }{ // TODO: Add test cases. - {"css", args{"test.css", []byte("body{margin:0;padding:0;background-color:#d579b2}#app{font-family:Avenir,Helvetica,Arial,sans-serif;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;text-align:center;color:#2c3e50;background-color:#ededed}#nav{padding:30px}#nav a{font-weight:700;color:#2c\n3e50}#nav a.router-link-exact-active{color:#42b983}.hello[data-v-4e26ad49]{margin:10px 0}")}, "text/css; charset=utf-8"}, - {"js", args{"test.js", []byte("let foo = 'bar'; console.log(foo);")}, "text/javascript; charset=utf-8"}, + {"nil data", args{"nil.svg", nil}, "text/plain"}, + {"empty data", args{"empty.html", emptyMsg}, "text/plain"}, + {"css", args{"test.css", css}, "text/css; charset=utf-8"}, + {"js", args{"test.js", []byte("let foo = 'bar'; console.log(foo);")}, "application/javascript"}, + {"html-utf8", args{"test_utf8.html", html}, "text/html; charset=utf-8"}, + {"html-bom-utf8", args{"test_bom_utf8.html", bomHtml}, "text/html; charset=utf-8"}, + {"svg", args{"test.svg", svg}, "image/svg+xml"}, + {"svg-w-comment", args{"test_comment.svg", svgWithComment}, "image/svg+xml"}, + {"svg-w-control-comment", args{"test_control_comment.svg", svgWithCommentAndControlChars}, "image/svg+xml"}, + {"svg-w-bom-control-comment", args{"test_bom_control_comment.svg", svgWithBomCommentAndControlChars}, "image/svg+xml"}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if got := GetMimetype(tt.args.filename, tt.args.data); got != tt.want { - t.Errorf("GetMimetype() = %v, want %v", got, tt.want) + t.Errorf("GetMimetype() = '%v', want '%v'", got, tt.want) } }) }