jenkinsci / minio-plugin

Repository for the Minio Jenkins plugin
https://plugins.jenkins.io/minio/
MIT License
10 stars 12 forks source link

Hardcoded content type on objects #58

Open torblerone opened 3 years ago

torblerone commented 3 years ago

Version report

Jenkins and plugins versions report:

not important
not important

Reproduction steps

Results

Expected result:

I expected to get the file delivered as HTML and view it in my browser.

Actual result:

The content-type of the object gets hardcoded here. This leads to the browser thinking its a download, which will prevent you from viewing the object as a HTML page.

Also, normally browsers look into octet-stream files and look what they can do with it, but MinIO server sets X-Content-Type-Options: nosniff on objects per default which is a good security feature.

I guess the above mentioned code line should be changed, thus the plugin no longer uploads objects with a hard-coded content-type. Maybe a similar approach to the mc CLI is possible, which does add at least some logic to setting the content-type.

As always, thanks for keeping up the project and providing us a Jenkins plugin! :smile:

torblerone commented 3 years ago

Hint for anyone looking into this: MIME type can be retrieved by Java standard library since Java 7, as seen here: JavaDoc - Files.probeContentType()

Edit: There's already an open pull request for this bug