• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

chubbyts / chubbyts-undici-static-file
100%

Build:
DEFAULT BRANCH: master
Repo Added 12 Sep 2025 05:42AM UTC
Token Znq7bmVZQRYu8fYwVuDmSU18AtQMQKuxP regen
Build 314 Last
Files 2
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: SELECT
CHANGE BRANCH
x
Sync Branches
  • No branch selected
  • chubbyts-http-static-file
  • master

21 Jul 2026 08:08PM UTC coverage: 100.0%. Remained the same
30139355668

push

github

dominikzogg
Content sniffing → stored XSS (conditional, medium)

If the extension is unknown, no Content-Type header is sent at all
(src/handler.ts:106) and there's no X-Content-Type-Options: nosniff.
Browsers will then sniff the body — if the served directory can contain
attacker-influenced files (uploads, generated content), an HTML/JS
payload with an unknown extension executes on your origin.
Fix: default to application/octet-stream and always send nosniff.

34 of 34 branches covered (100.0%)

Branch coverage included in aggregate %.

56 of 56 relevant lines covered (100.0%)

20.68 hits per line

Relevant lines Covered
Build:
Build:
56 RELEVANT LINES 56 COVERED LINES
20.68 HITS PER LINE
Source Files on master
  • Tree
  • List 2
  • Changed 1
  • Source Changed 1
  • Coverage Changed 1
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
30139355668 master Content sniffing → stored XSS (conditional, medium) If the extension is unknown, no Content-Type header is sent at all (src/handler.ts:106) and there's no X-Content-Type-Options: nosniff. Browsers will then sniff the body — if the served director... push 25 Jul 2026 01:53AM UTC dominikzogg github
100.0
30060148971 master Content sniffing → stored XSS (conditional, medium) If the extension is unknown, no Content-Type header is sent at all (src/handler.ts:106) and there's no X-Content-Type-Options: nosniff. Browsers will then sniff the body — if the served director... push 24 Jul 2026 01:53AM UTC dominikzogg github
100.0
29973130672 master Content sniffing → stored XSS (conditional, medium) If the extension is unknown, no Content-Type header is sent at all (src/handler.ts:106) and there's no X-Content-Type-Options: nosniff. Browsers will then sniff the body — if the served director... push 23 Jul 2026 01:58AM UTC dominikzogg github
100.0
29884172892 master Content sniffing → stored XSS (conditional, medium) If the extension is unknown, no Content-Type header is sent at all (src/handler.ts:106) and there's no X-Content-Type-Options: nosniff. Browsers will then sniff the body — if the served director... push 22 Jul 2026 01:51AM UTC dominikzogg github
100.0
29864501463 master Content sniffing → stored XSS (conditional, medium) If the extension is unknown, no Content-Type header is sent at all (src/handler.ts:106) and there's no X-Content-Type-Options: nosniff. Browsers will then sniff the body — if the served director... push 21 Jul 2026 08:09PM UTC dominikzogg github
100.0
29862279984 master security fixes - resolve public directory and requested file via realpath and only serve files strictly inside the public directory (rejects escaping symlinks, defense-in-depth against path traversal) - only serve regular files: directo... push 21 Jul 2026 07:38PM UTC dominikzogg github
100.0
29067304988 master add node 26 testing push 10 Jul 2026 03:40AM UTC dominikzogg github
100.0
28992266863 master add node 26 testing push 09 Jul 2026 03:38AM UTC dominikzogg github
100.0
28914773671 master add node 26 testing push 08 Jul 2026 03:14AM UTC dominikzogg github
100.0
28839987286 master add node 26 testing push 07 Jul 2026 03:46AM UTC dominikzogg github
100.0
See All Builds (314)

Badge your Repo: chubbyts-undici-static-file

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.

Could not find badge in README.

Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh
  • Settings
  • Repo on GitHub
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE TRIAL · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc