chubbyts / chubbyts-undici-static-file / 30139355668

100%

push

github

Content sniffing → stored XSS (conditional, medium)

If the extension is unknown, no Content-Type header is sent at all
(src/handler.ts:106) and there's no X-Content-Type-Options: nosniff.
Browsers will then sniff the body — if the served directory can contain
attacker-influenced files (uploads, generated content), an HTML/JS
payload with an unknown extension executes on your origin.
Fix: default to application/octet-stream and always send nosniff.

34 of 34 branches covered (100.0%)

Branch coverage included in aggregate %.

5 of 0 new or added lines in 0 files covered. (NaN%)

56 of 56 relevant lines covered (100.0%)

20.68 hits per line