From: Matt Selsky <selsky@columbia.edu>
Date: Sun, 9 Sep 2012 18:06:39 +0000 (-0700)
Subject: Bug 671612: Send "X-Content-Type-Options: nosniff" with every response
X-Git-Tag: bugzilla-4.2.4~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=36d868c007f778e72ae31c521595515f428edae0;p=thirdparty%2Fbugzilla.git

Bug 671612: Send "X-Content-Type-Options: nosniff" with every response
r/a=LpSolit
---

diff --git a/Bugzilla/Attachment/PatchReader.pm b/Bugzilla/Attachment/PatchReader.pm
index 01a624a8fa..cfc7610f40 100644
--- a/Bugzilla/Attachment/PatchReader.pm
+++ b/Bugzilla/Attachment/PatchReader.pm
@@ -37,7 +37,6 @@ sub process_diff {
         $last_reader->sends_data_to(new PatchReader::DiffPrinter::raw());
         # Actually print out the patch.
         print $cgi->header(-type => 'text/plain',
-                           -x_content_type_options => "nosniff",
                            -expires => '+3M');
         disable_utf8();
         $reader->iterate_string('Attachment ' . $attachment->id, $attachment->data);
@@ -119,7 +118,6 @@ sub process_interdiff {
         $last_reader->sends_data_to(new PatchReader::DiffPrinter::raw());
         # Actually print out the patch.
         print $cgi->header(-type => 'text/plain',
-                           -x_content_type_options => "nosniff",
                            -expires => '+3M');
         disable_utf8();
     }
diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm
index 7135f7c48a..a16ae66865 100644
--- a/Bugzilla/CGI.pm
+++ b/Bugzilla/CGI.pm
@@ -316,6 +316,10 @@ sub header {
         unshift(@_, '-x_frame_options' => 'SAMEORIGIN');
     }
 
+    # Add X-Content-Type-Options header to prevent browsers sniffing
+    # the MIME type away from the declared Content-Type.
+    unshift(@_, '-x_content_type_options' => 'nosniff');
+
     return $self->SUPER::header(@_) || "";
 }
 
diff --git a/attachment.cgi b/attachment.cgi
index 04bad37b3e..64f78dc36d 100755
--- a/attachment.cgi
+++ b/attachment.cgi
@@ -408,8 +408,7 @@ sub view {
     }
     print $cgi->header(-type=>"$contenttype; name=\"$filename\"",
                        -content_disposition=> "$disposition; filename=\"$filename\"",
-                       -content_length => $attachment->datasize,
-                       -x_content_type_options => "nosniff");
+                       -content_length => $attachment->datasize);
     disable_utf8();
     print $attachment->data;
 }