diff --git a/src/main/scala/app/AccountController.scala b/src/main/scala/app/AccountController.scala index 4560267..8311654 100644 --- a/src/main/scala/app/AccountController.scala +++ b/src/main/scala/app/AccountController.scala @@ -135,9 +135,7 @@ get("/:userName/_avatar"){ val userName = params("userName") getAccountByUserName(userName).flatMap(_.image).map { image => - outputUploadedRawData( - FileUtil.getMimeType(image), - new java.io.File(getUserUploadDir(userName), image)) + RawData(FileUtil.getMimeType(image), new java.io.File(getUserUploadDir(userName), image)) } getOrElse { contentType = "image/png" Thread.currentThread.getContextClassLoader.getResourceAsStream("noimage.png") diff --git a/src/main/scala/app/ControllerBase.scala b/src/main/scala/app/ControllerBase.scala index be8d37a..8a184f0 100644 --- a/src/main/scala/app/ControllerBase.scala +++ b/src/main/scala/app/ControllerBase.scala @@ -134,8 +134,10 @@ if (path.startsWith("http")) path else baseUrl + super.url(path, params, false, false, false) - /** against XSS */ - def outputUploadedRawData[DATATYPE](contentType: String, rawData: DATATYPE): DATATYPE = { + /** + * Use this method to response the raw data against XSS. + */ + protected def RawData[T](contentType: String, rawData: T): T = { if(contentType.split(";").head.trim.toLowerCase.startsWith("text/html")){ this.contentType = "text/plain" } else { diff --git a/src/main/scala/app/IssuesController.scala b/src/main/scala/app/IssuesController.scala index 7abab1a..063b8b2 100644 --- a/src/main/scala/app/IssuesController.scala +++ b/src/main/scala/app/IssuesController.scala @@ -292,7 +292,7 @@ (Directory.getAttachedDir(repository.owner, repository.name) match { case dir if(dir.exists && dir.isDirectory) => dir.listFiles.find(_.getName.startsWith(params("file") + ".")).map { file => - outputUploadedRawData(FileUtil.getMimeType(file.getName), file) + RawData(FileUtil.getMimeType(file.getName), file) } case _ => None }) getOrElse NotFound diff --git a/src/main/scala/app/RepositoryViewerController.scala b/src/main/scala/app/RepositoryViewerController.scala index de2a6ad..57b1027 100644 --- a/src/main/scala/app/RepositoryViewerController.scala +++ b/src/main/scala/app/RepositoryViewerController.scala @@ -214,7 +214,7 @@ if(raw){ // Download defining(JGitUtil.getContentFromId(git, objectId, false).get){ bytes => - outputUploadedRawData(FileUtil.getContentType(path, bytes), bytes) + RawData(FileUtil.getContentType(path, bytes), bytes) } } else { repo.html.blob(id, repository, path.split("/").toList, JGitUtil.getContentInfo(git, path, objectId), diff --git a/src/main/scala/app/WikiController.scala b/src/main/scala/app/WikiController.scala index ea43491..c273018 100644 --- a/src/main/scala/app/WikiController.scala +++ b/src/main/scala/app/WikiController.scala @@ -164,7 +164,7 @@ val path = multiParams("splat").head getFileContent(repository.owner, repository.name, path).map { bytes => - outputUploadedRawData(FileUtil.getContentType(path, bytes), bytes) + RawData(FileUtil.getContentType(path, bytes), bytes) } getOrElse NotFound })