SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Enforce mime type 'application/json' when uploading advisories to the provider.

Browse source
This commit is contained in:
Sascha L. Teichmann 2023-02-01 00:32:30 +01:00
parent e998133429
commit 7cc37bd9fc
2 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
cmd/csaf_provider/actions.go
View file

@ -42,6 +42,11 @@ func (c *controller) loadCSAF(r *http.Request) (string, []byte, error) {
}
defer file.Close()
// We reject everything which is not announced as JSON.
if handler.Header.Get("Content-Type") != "application/json" {
return "", nil, errors.New("expected content type 'application/json'")
}
if !util.ConfirmingFileName(handler.Filename) {
return "", nil, errors.New("given csaf filename is not confirming")
}