From 4f4f1c642ad77886a9b5716ad886cde556858a60 Mon Sep 17 00:00:00 2001
From: Jesse Gonyou <168374102+jessegonyou@users.noreply.github.com>
Date: Mon, 2 Jun 2025 06:52:44 -0400
Subject: [PATCH] Update fix for potential XSS on /view (#8384)

* Update fix for potential XSS on /view

This commit uses mimetypes to add more restricted filetypes to prevent from being served, since mimetypes are what browsers use to determine how to serve files.

* Fix typo

Fixed a typo that prevented the program from running
---
 server.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/server.py b/server.py
index 6e283fe3..aca67a2e 100644
--- a/server.py
+++ b/server.py
@@ -476,9 +476,8 @@ class PromptServer():
                         # Get content type from mimetype, defaulting to 'application/octet-stream'
                         content_type = mimetypes.guess_type(filename)[0] or 'application/octet-stream'
 
-                        # For security, force certain extensions to download instead of display
-                        file_extension = os.path.splitext(filename)[1].lower()
-                        if file_extension in {'.html', '.htm', '.js', '.css'}:
+                        # For security, force certain mimetypes to download instead of display
+                        if content_type in {'text/html', 'text/html-sandboxed', 'application/xhtml+xml', 'text/javascript', 'text/css'}:
                             content_type = 'application/octet-stream'  # Forces download
 
                         return web.FileResponse(