Browse Source
Merge pull request #13927 from dashevchenko/svgCodeInjection
Malicious code injection into the SVG image vulnerability
pull/14050/head
Viacheslav Klimov
1 year ago
committed by
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with
1 additions and
0 deletions
-
application/src/main/java/org/thingsboard/server/controller/ImageController.java
|
|
|
@ -300,6 +300,7 @@ public class ImageController extends BaseController { |
|
|
|
tbImageService.putETag(cacheKey, descriptor.getEtag()); |
|
|
|
var result = ResponseEntity.ok() |
|
|
|
.header("Content-Type", descriptor.getMediaType()) |
|
|
|
.header("Content-Security-Policy", "default-src 'none'") |
|
|
|
.eTag(descriptor.getEtag()); |
|
|
|
if (!cacheKey.isPublic()) { |
|
|
|
result |
|
|
|
|
