jesse-a/OpenCRM
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions

MIME-validatie ontbrak bij uploads + downloads serveerden zonder nosniff #104

New issue
Closed
opened 2026-05-26 18:23:36 +00:00 by jesse-a · 1 comment
jesse-a commented 2026-05-26 18:23:36 +00:00
Owner
Copy link

Severity: MEDIUM (v0.11)

Uploads accepteerden elke file.type, en download-responses zetten geen X-Content-Type-Options: nosniff. In combinatie kon een aanvaller een HTML-file met MIME image/png uploaden en die door browsers-die-MIME-sniffen laten renderen als HTML — stored-XSS-pad.

Fix: MIME-allow-list bij upload (alleen PDF + image/{png,jpeg,webp}) + nosniff op alle download-routes via safeDownloadHeaders() helper.

**Severity: MEDIUM** (v0.11) Uploads accepteerden elke `file.type`, en download-responses zetten geen `X-Content-Type-Options: nosniff`. In combinatie kon een aanvaller een HTML-file met MIME `image/png` uploaden en die door browsers-die-MIME-sniffen laten renderen als HTML — stored-XSS-pad. **Fix**: MIME-allow-list bij upload (alleen PDF + image/{png,jpeg,webp}) + `nosniff` op alle download-routes via `safeDownloadHeaders()` helper.
jesse-a commented 2026-05-26 18:23:37 +00:00
Author
Owner
Copy link

Opgelost in commit 936daf0.

Opgelost in commit 936daf0.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v1.0.0
v0.11
v0.10
v0.9
v0.8
v0.7
v0.6
v0.5
Labels
Clear labels   
deferred
Known issue, deferred

  
fixed
Resolved

  
security
Security review finding

  
severity-high
High severity

  
severity-low
Low severity

  
severity-medium
Medium severity

No labels
deferred
fixed
security
severity-high
severity-low
severity-medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jesse-a/OpenCRM#104
No description provided.