chubbyphp / chubbyphp-static-file

100%

master: 100%

push

github

Prevent MIME sniffing: default Content-Type, always send nosniff (Fable 5)

If the extension was unknown, no Content-Type header was sent at all and
there was no X-Content-Type-Options: nosniff. Browsers would then sniff
the body - if the served directory can contain attacker-influenced files
(uploads, generated content), an HTML/JS payload with an unknown
extension executes on the origin.

Fix: default to application/octet-stream and always send
X-Content-Type-Options: nosniff on every response (200, 304, HEAD).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2 of 2 new or added lines in 1 file covered. (100.0%)

47 of 47 relevant lines covered (100.0%)

78.38 hits per line