efforting.tech/gitea
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): set X-Content-Type-Options: nosniff by default (#37354)

Browse Source 
Fixes #37316.

---------

Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com>
Co-authored-by: SAY-5 <SAY-5@users.noreply.github.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Sai Asish Y
2026-04-24 04:21:34 -07:00
committed by GitHub
parent 1483291a87
commit 6826321570
7 changed files with 45 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
tests/integration/view_test.go
View File

@@ -12,9 +12,14 @@ import (
"github.com/stretchr/testify/assert"
)
func TestRenderFileSVGIsInImgTag(t *testing.T) {
func TestView(t *testing.T) {
defer tests.PrepareTestEnv(t)()
t.Run("RenderFileSVGIsInImgTag", testRenderFileSVGIsInImgTag)
t.Run("CommitListActions", testCommitListActions)
t.Run("SecurityHeadersDefaults", testSecurityHeadersDefaults)
}
func testRenderFileSVGIsInImgTag(t *testing.T) {
session := loginUser(t, "user2")
req := NewRequest(t, "GET", "/user2/repo2/src/branch/master/line.svg")
@@ -26,8 +31,7 @@ func TestRenderFileSVGIsInImgTag(t *testing.T) {
assert.Equal(t, "/user2/repo2/raw/branch/master/line.svg", src)
}
func TestCommitListActions(t *testing.T) {
defer tests.PrepareTestEnv(t)()
func testCommitListActions(t *testing.T) {
session := loginUser(t, "user2")
t.Run("WikiRevisionList", func(t *testing.T) {
@@ -65,3 +69,15 @@ func TestCommitListActions(t *testing.T) {
AssertHTMLElement(t, htmlDoc, `.commit-list .view-commit-path`, true)
})
}
func testSecurityHeadersDefaults(t *testing.T) {
assertSecurityHeaders := func(t *testing.T, uri string) {
req := NewRequest(t, "GET", uri)
resp := MakeRequest(t, req, http.StatusOK)
assert.Equal(t, "nosniff", resp.Header().Get("X-Content-Type-Options"))
assert.Equal(t, "SAMEORIGIN", resp.Header().Get("X-Frame-Options"))
}
assertSecurityHeaders(t, "/")
assertSecurityHeaders(t, "/api/v1/version")
assertSecurityHeaders(t, "/assets/img/favicon.png")
}