From: Eric Wong <e@80x24.org>
Date: Mon, 23 Nov 2020 14:15:35 +0000 (+0000)
Subject: wwwattach: prevent deep-linking via Referer match
X-Git-Tag: v1.6.1~14
X-Git-Url: http://www.git.stargrave.org/?a=commitdiff_plain;h=c39ed01a3a4c6c4634642eb875a16538aceacfc3;hp=c39ed01a3a4c6c4634642eb875a16538aceacfc3;p=public-inbox.git

wwwattach: prevent deep-linking via Referer match

This prevents `<img src=' tags from being used to deep-link
image attachments from HTML outside of the current host and
reduces potential for abuse.

Some browsers (e.g. Firefox) favor content detection and will
display images irrespective of the Content-Type header being
"application/octet-stream", and "Content-Disposition: attachment"
doesn't stop them, either.

Tested with dillo and Firefox.

Reported-by: Leah Neukirchen <leah@vuxu.org>
(cherry picked from commit 46cbc5a7a4ba917bd7154be3b6e6898420ff85d3)
---