From 97ae0b4f82910d12f266450131ba2b5abc52815b Mon Sep 17 00:00:00 2001 From: sbassett Date: Mon, 13 Jan 2020 15:17:39 -0600 Subject: [PATCH] SECURITY: Update mime and content types downloads Change the following mime and content types from "text/html; charset=utf-8" to the appropriate values for csv and tsv file downloads: * csv: "text/csv; charset=utf-8" * tsv: "text/tab-separated-values; charset=utf-8" Bug: T242355 --- quarry/web/output.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/quarry/web/output.py b/quarry/web/output.py index f8b4c48..8dd08d3 100644 --- a/quarry/web/output.py +++ b/quarry/web/output.py @@ -107,11 +107,16 @@ def separated_formatter(reader, resultset_id, delim=','): rows = _stringify_results(_csv_injection_escape( reader.get_rows(resultset_id))) + mime_type = 'text/csv' if delim == ',' else 'text/tab-separated-values' + content_type = ''.join([mime_type, '; charset=utf-8']) + def respond(stream): csvobject = csv.writer(stream, delimiter=delim) csvobject.writerows(rows) - return Response(_IterI(respond), content_type='text/html; charset=utf-8') + return Response(_IterI(respond), + mimetype=mime_type, + content_type=content_type) def json_line_formatter(reader, resultset_id): -- 2.22.0