fionera
/
datatrash
forked from neri/datatrash
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

always add X-Content-Type-Options: nosniff header

This commit is contained in:
neri 2022-08-24 10:32:51 +02:00
parent 4496335f50
commit 4ea8797149
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/download.rs
View File

@ -6,7 +6,7 @@ use actix_web::{
http::header::{ http::header::{
Accept, CacheControl, CacheDirective, Charset, ContentDisposition, DispositionParam, Accept, CacheControl, CacheDirective, Charset, ContentDisposition, DispositionParam,
DispositionType, Expires, ExtendedValue, Header, HeaderValue, HttpDate, TryIntoHeaderValue, DispositionType, Expires, ExtendedValue, Header, HeaderValue, HttpDate, TryIntoHeaderValue,
ACCEPT, CACHE_CONTROL, CONTENT_TYPE, EXPIRES, VARY, X_CONTENT_TYPE_OPTIONS, ACCEPT, CACHE_CONTROL, CONTENT_TYPE, EXPIRES, VARY,
}, },
web, Error, HttpRequest, HttpResponse, web, Error, HttpRequest, HttpResponse,
}; };
@ -183,9 +183,6 @@ fn add_headers(req: &HttpRequest, download: bool, response: &mut HttpResponse) {
HeaderValue::from_str(APPLICATION_OCTET_STREAM.as_ref()) HeaderValue::from_str(APPLICATION_OCTET_STREAM.as_ref())
.expect("mime type can be encoded to header value"), .expect("mime type can be encoded to header value"),
); );
response
.headers_mut()
.insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));
} }
// the reponse varies based on these request headers // the reponse varies based on these request headers
response response

8
src/main.rs
View File

@ -11,7 +11,7 @@ use crate::rate_limit::ForwardedPeerIpKeyExtractor;
use actix_files::Files; use actix_files::Files;
use actix_governor::{Governor, GovernorConfigBuilder}; use actix_governor::{Governor, GovernorConfigBuilder};
use actix_web::{ use actix_web::{
http::header::{HeaderName, CONTENT_SECURITY_POLICY}, http::header::{HeaderName, HeaderValue, CONTENT_SECURITY_POLICY, X_CONTENT_TYPE_OPTIONS},
middleware::{self, DefaultHeaders, Logger}, middleware::{self, DefaultHeaders, Logger},
web::{self, Data}, web::{self, Data},
App, Error, HttpResponse, HttpServer, App, Error, HttpResponse, HttpServer,
@ -69,7 +69,11 @@ async fn main() -> std::io::Result<()> {
move || { move || {
let app = App::new() let app = App::new()
.wrap(Logger::new(r#"%{r}a "%r" =%s %bbytes %Tsec"#)) .wrap(Logger::new(r#"%{r}a "%r" =%s %bbytes %Tsec"#))
.wrap(DefaultHeaders::new().add(DEFAULT_CSP)) .wrap(
DefaultHeaders::new()
.add(DEFAULT_CSP)
.add((X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"))),
)
.wrap(middleware::Compress::default()) .wrap(middleware::Compress::default())
.app_data(db.clone()) .app_data(db.clone())
.app_data(expiry_watch_sender.clone()) .app_data(expiry_watch_sender.clone())