Skip to content

Commit f72ce26

Browse files
faridtslzeripath
andauthored
Add Content-Length header to HEAD requests (#14542)
* Add Content-Length header to HEAD requests This change adds the header Content-Length to HEAD HTTP requests. The previous behaviour was blocking some Windows executables (i.e bitsadmin.exe) from downloading files hosted in Gitea. This along with PR #14541, makes the web server compliant with HTTP RFC 2616 which states "The methods GET and HEAD MUST be supported by all general-purpose servers" and "The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response." This should also respond to issues #8030 and #14532. * This change adds the header Content-Length to HEAD HTTP requests Pass the Size of the content as a parameter to ServeData() instead of calculating it using ioutil.ReadAll(reader) --> this call is dangerous and can result in a denial of service. * Add Content-Length header to HEAD requests Quick fix for imported dependency not used. * Check if size is positiv int ... Co-authored-by: zeripath <[email protected]>
1 parent 4457d0e commit f72ce26

File tree

2 files changed

+9
-4
lines changed

2 files changed

+9
-4
lines changed

routers/repo/attachment.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ func GetAttachment(ctx *context.Context) {
152152
return
153153
}
154154

155-
if err = ServeData(ctx, attach.Name, fr); err != nil {
155+
if err = ServeData(ctx, attach.Name, attach.Size, fr); err != nil {
156156
ctx.ServerError("ServeData", err)
157157
return
158158
}

routers/repo/download.go

+8-3
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import (
2020
)
2121

2222
// ServeData download file from io.Reader
23-
func ServeData(ctx *context.Context, name string, reader io.Reader) error {
23+
func ServeData(ctx *context.Context, name string, size int64, reader io.Reader) error {
2424
buf := make([]byte, 1024)
2525
n, err := reader.Read(buf)
2626
if err != nil && err != io.EOF {
@@ -31,6 +31,11 @@ func ServeData(ctx *context.Context, name string, reader io.Reader) error {
3131
}
3232

3333
ctx.Resp.Header().Set("Cache-Control", "public,max-age=86400")
34+
if size >= 0 {
35+
ctx.Resp.Header().Set("Content-Length", fmt.Sprintf("%d", size))
36+
} else {
37+
log.Error("ServeData called to serve data: %s with size < 0: %d", name, size)
38+
}
3439
name = path.Base(name)
3540

3641
// Google Chrome dislike commas in filenames, so let's change it to a space
@@ -76,7 +81,7 @@ func ServeBlob(ctx *context.Context, blob *git.Blob) error {
7681
}
7782
}()
7883

79-
return ServeData(ctx, ctx.Repo.TreePath, dataRc)
84+
return ServeData(ctx, ctx.Repo.TreePath, blob.Size(), dataRc)
8085
}
8186

8287
// ServeBlobOrLFS download a git.Blob redirecting to LFS if necessary
@@ -105,7 +110,7 @@ func ServeBlobOrLFS(ctx *context.Context, blob *git.Blob) error {
105110
log.Error("ServeBlobOrLFS: Close: %v", err)
106111
}
107112
}()
108-
return ServeData(ctx, ctx.Repo.TreePath, lfsDataRc)
113+
return ServeData(ctx, ctx.Repo.TreePath, meta.Size, lfsDataRc)
109114
}
110115

111116
return ServeBlob(ctx, blob)

0 commit comments

Comments
 (0)