summaryrefslogtreecommitdiff
path: root/modules/caddyhttp/fileserver
diff options
context:
space:
mode:
authorMatthew Holt <mholt@users.noreply.github.com>2019-06-07 19:59:17 -0600
committerMatthew Holt <mholt@users.noreply.github.com>2019-06-07 19:59:25 -0600
commitef5f29cfb257c7503763a4b16947c4eb6a7864c3 (patch)
tree2bceddc23e11434e1bbf7361adf045ec52b12c52 /modules/caddyhttp/fileserver
parent8947ae0cc1babf2ca6f8e01aa93cb13eebb3e854 (diff)
Do not allow Go standard lib to sniff Content-Type header
Diffstat (limited to 'modules/caddyhttp/fileserver')
-rw-r--r--modules/caddyhttp/fileserver/staticfiles.go5
1 files changed, 4 insertions, 1 deletions
diff --git a/modules/caddyhttp/fileserver/staticfiles.go b/modules/caddyhttp/fileserver/staticfiles.go
index 86704fa..d094406 100644
--- a/modules/caddyhttp/fileserver/staticfiles.go
+++ b/modules/caddyhttp/fileserver/staticfiles.go
@@ -185,7 +185,10 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) error
// TODO: Etag
- // TODO: Disable content-type sniffing by setting a content-type...
+ // do not allow Go to sniff the content-type
+ if w.Header().Get("Content-Type") == "" {
+ w.Header()["Content-Type"] = nil
+ }
// let the standard library do what it does best; note, however,
// that errors generated by ServeContent are written immediately