Skip to content

fix(fetchkit): tighten content-type checks for markdown and text#125

Merged
chaliy merged 2 commits into
mainfrom
2026-05-17-fix-content-type-detection-vulnerability
May 17, 2026
Merged

fix(fetchkit): tighten content-type checks for markdown and text#125
chaliy merged 2 commits into
mainfrom
2026-05-17-fix-content-type-detection-vulnerability

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented May 17, 2026

Motivation

  • Substring-based Content-Type checks could misclassify text/html responses that include parameters like profile="text/markdown" as markdown or plain text, allowing raw HTML (including <script>/iframe) to bypass the HTML conversion sanitization.

Description

  • Change is_markdown_content_type and is_plain_text_content_type to parse only the primary media type token (the part before ;) and compare it with eq_ignore_ascii_case after trimming.
  • Add regression assertions to the unit tests to ensure headers like text/html; profile="text/markdown" and text/html; profile="text/plain" are not treated as markdown/plain text.
  • This is a minimal behavioral fix that preserves existing functionality for legitimate text/markdown and text/plain media types while preventing parameter-based spoofing.

Testing

  • Ran cargo test -p fetchkit is_markdown_content_type and the updated test_is_markdown_content_type passed.
  • Ran cargo test -p fetchkit is_plain_text_content_type and the updated test_is_plain_text_content_type passed.
  • The change is limited to content-type detection and does not alter the HTML conversion code paths beyond restoring correct sanitization routing.

Codex Task

@chaliy chaliy merged commit 5cb749c into main May 17, 2026
11 checks passed
@chaliy chaliy deleted the 2026-05-17-fix-content-type-detection-vulnerability branch May 17, 2026 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant