CVE-2022-40931

An attacker uploads a file containing JavaScript payload (e.g., an HTML file) whose Content-Type is empty or cannot be determined by the server. When a victim accesses the file with the `?inline` query parameter, the server sets `Content-Disposition: inline` but fails to set a safe Content-Type, leaving the browser to sniff the content and execute the embedded script. The attack requires no authentication and is triggered simply by visiting the crafted URL [patch_id=1641272].

The vulnerability resides in `server/handlers.go` within the `getHandler` function. When the `action` parameter is `"inline"`, the code sets `disposition = "inline"` but does not validate whether `contentType` is empty. This allows files with an undetermined MIME type to be served inline without a safe fallback content-type header [patch_id=1641272].

The patch adds a guard in `server/handlers.go` inside the `getHandler` function: if `strings.TrimSpace(contentType)` is empty when the `action` is `"inline"`, the content type is forced to `"text/plain"`. This prevents the browser from MIME-sniffing attacker-controlled content as HTML or JavaScript. By always serving a safe, explicit MIME type for inline-displayed files with an undetermined content type, the XSS vector is closed [patch_id=1641272].