From df7db6cfc232bad9f008fb5d683410b6e45fb90c Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 15 Oct 2026 19:37:44 +0200 Subject: [PATCH] docs(19.3-05): log S3 object content-type observation in deferred items --- .../deferred-items.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/deferred-items.md b/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/deferred-items.md index cb0dac8..316e9c9 100644 --- a/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/deferred-items.md +++ b/.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/deferred-items.md @@ -12,3 +12,7 @@ Out-of-scope findings logged by executors. Not fixed in the plan that found them - Pre-existing gofmt findings (missing trailing newlines), untouched by 19.3-04: `modules/cabana/account_tokens.go`, `modules/cabana/account_tokens_test.go`, `modules/cabana/token_postgres_smoke_test.go`, `modules/cabana/token_routes_test.go`, `modules/cabana/token_scopes_test.go`, and in the Journal plugin `classes/blog_editor_test.go`. `go vet` and the suites are unaffected. - Deployment follow-up: move the grzybyfunkcjonalne deployment from `golem15.journal.site_cache.*` and `NUXT_JOURNAL_CACHE_PURGE_TOKEN` to `site_cache.purge_url`/`site_cache.purge_token` and `NUXT_SITE_CACHE_PURGE_TOKEN` (route `/api/__site__/cache/purge`) before the Journal alias keys are removed. - `sm-summercmsio-app` mounts the Journal plugin 45 commits behind main; bump its pointer in a separate follow-up. + +## From 19.3-05 + +- Security observation (not a test failure; plan 03 kept the stored `content_type` rule by design): `attach.Store` writes the blob with the sniffed content type as object metadata, so an HTML body uploaded as `note.txt` is stored as `.txt` with `Content-Type: text/html`, and a generic sniff takes the type from the extension (`app.js` with binary bytes is stored as `.bin` with `text/javascript`). The surf uploads route neutralises this (nosniff, sandbox CSP, attachment disposition), but with `storage.uploads.public_url` pointing at an S3 bucket the bucket serves the object's stored Content-Type directly, so such a file renders as HTML on the bucket or CDN host. `docs/services/storage.md`'s deploy note says a CDN "picks the Content-Type from the file extension", which is not true for S3 object metadata. A follow-up could write a non-rendering content type (or `Content-Disposition: attachment`) for non-inline types to the blob metadata, and correct the deploy note. Pinned by `TestStoreDiskExtension` rows "html named txt" and "js under octet-stream".