mirror of
https://github.com/makeplane/plane.git
synced 2026-08-29 10:08:51 +02:00
9dff20e048
* [WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) Add SCRIPT_CAPABLE_MIME_TYPES frozenset (image/svg+xml, text/javascript, application/javascript, text/html, application/xhtml+xml, text/xml, application/xml) and enforce Content-Disposition: attachment on three download endpoints that previously defaulted to inline serving: - GenericAssetEndpoint.get (api/views/asset.py) - StaticFileAssetEndpoint.get (app/views/asset/v2.py) - EntityAssetEndpoint.get (space/views/asset.py) ATTACHMENT_MIME_TYPES is unchanged — users can still upload SVG, JS, and XML files. The fix closes the XSS vector by ensuring script-capable assets are always downloaded rather than rendered in the application's origin. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-7887] fix: normalize MIME type before SCRIPT_CAPABLE_MIME_TYPES check Strip MIME parameters and lowercase before the allowlist check so that stored values like "image/svg+xml; charset=utf-8" or "Image/SVG+XML" are correctly identified as script-capable and served as attachment. Applies to all three download endpoints. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>