chubbyts / chubbyts-undici-static-file / 29973130672 / 1

100%

master: 100%

push

github

Content sniffing → stored XSS (conditional, medium)

If the extension is unknown, no Content-Type header is sent at all
(src/handler.ts:106) and there's no X-Content-Type-Options: nosniff.
Browsers will then sniff the body — if the served directory can contain
attacker-influenced files (uploads, generated content), an HTML/JS
payload with an unknown extension executes on your origin.
Fix: default to application/octet-stream and always send nosniff.

36 of 36 branches covered (100.0%)

Branch coverage included in aggregate %.

112 of 112 relevant lines covered (100.0%)

10.34 hits per line