diff options
author | Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com> | 2021-12-16 15:12:13 +0100 |
---|---|---|
committer | Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com> | 2021-12-17 09:50:28 +0100 |
commit | 44954497bcb2d6d589b9340a43323663061c7b42 (patch) | |
tree | 0d0d06b11e462ccff1a908c2b1c4dfd039b82787 /media/testdata/resource.svg | |
parent | 22ef5da20d1685dfe6aff3bd9364c9b1f1d0d8f8 (diff) |
Always use content to resolve content type in resources.GetRemote
This is a security hardening measure; don't trust the URL extension or any `Content-Type`/`Content-Disposition` header on its own, always look at the file content using Go's `http.DetectContentType`.
This commit also adds ttf and otf media type definitions to Hugo.
Fixes #9302
Fixes #9301
Diffstat (limited to 'media/testdata/resource.svg')
-rw-r--r-- | media/testdata/resource.svg | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/media/testdata/resource.svg b/media/testdata/resource.svg new file mode 100644 index 000000000..2759ae703 --- /dev/null +++ b/media/testdata/resource.svg @@ -0,0 +1,5 @@ +<svg height="100" width="100"> + <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /> + Sorry, your browser does not support inline SVG. +</svg> +
\ No newline at end of file |