CORS proxy: Consider constraining supporting Content-Types to reduce opportunities for abuse

WordPress / wordpress-playground

Run WordPress in the browser via WebAssembly PHP

https://w.org/playground/

GNU General Public License v2.0

1.65k stars 261 forks source link

CORS proxy: Consider constraining supporting Content-Types to reduce opportunities for abuse #1977

Open brandonpayton opened 3 weeks ago

brandonpayton commented 3 weeks ago

Perhaps constraining what response Content-Types the proxy allows will reduce the opportunities for abuse.

We could even adjust constraints based on URL. For example, maybe we don't always want to allow application/octet-stream but can allow it for URLs whose paths end with .zip, but maybe we could always allow "application/rss+xml" or "application/atom+xml".