[SOLR-15678] Disallow html content-type in ShowFileRequestHandler

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.11
• Assignee: Jan Høydahl
• Reporter: Jan Høydahl
• Created: 06/Oct/21 16:07
• Updated: 17/Dec/21 14:36
• Resolved: 11/Oct/21 08:52

Description

ShowFileRequestHandler will return a file from a configSet, and is used in the Admin UI. It returns the file using its proper content type, so browsers will render JSON, XML and plain text correctly. However, for html files (although unllikely in a configset) it is better to render as plain-text in a browser. Both to avoid XSS and since users would want to see the html code, not a rendered page.

Issue Links

• causes: SOLR-15804 Unable to view XML files via the Solr Collection GUI
• links to: GitHub Pull Request #336
• links to: GitHub Pull Request #2589