JSPWIKI-1280 see jira for details

jspwiki-main/src/main/java/org/apache/wiki/attachment/AttachmentServlet.java

@@ -29,6 +29,7 @@ Licensed to the Apache Software Foundation (ASF) under one
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Properties;
+import java.util.Set;
 
 import org.apache.commons.fileupload2.core.DiskFileItemFactory;
 import org.apache.commons.fileupload2.core.FileItem;
@@ -91,6 +92,12 @@ public class AttachmentServlet extends HttpServlet {
     private static final Logger LOG = LogManager.getLogger( AttachmentServlet.class );
     private static final String HDR_VERSION = "version";
 
+    /** Allowlist of passive content types which may be served inline; everything else forces a download. */
+    private static final Set< String > INLINE_SAFE_TYPES = Set.of(
+            "image/png", "image/jpeg", "image/gif", "image/webp", "image/bmp",
+            "image/avif", "image/tiff", "image/x-icon", "image/vnd.microsoft.icon",
+            "text/plain" );
+
     /** The maximum size that an attachment can be. */
     private int m_maxSize = Integer.MAX_VALUE;
 
@@ -225,7 +232,7 @@ public void doGet( final HttpServletRequest  req, final HttpServletResponse res
                 final String mimetype = getMimeType( context, att.getFileName() );
                 res.setContentType( mimetype );
 
-                final String contentDisposition = getContentDisposition( att );
+                final String contentDisposition = getContentDisposition( att, mimetype );
                 res.addHeader( "Content-Disposition", contentDisposition );
                 res.addDateHeader("Last-Modified",att.getLastModified().getTime());
 
@@ -292,17 +299,35 @@ public void doGet( final HttpServletRequest  req, final HttpServletResponse res
         }
     }
 
-    String getContentDisposition( final Attachment att ) {
-        // We use 'inline' instead of 'attachment' so that user agents can try to automatically open the file,
-        // except those cases in which we want to enforce the file download.
-        String contentDisposition = "inline; filename=\"";
-        if( m_engine.getManager( AttachmentManager.class ).forceDownload( att.getFileName() ) ) {
-            contentDisposition = "attachment; filename=\"";
+    String getContentDisposition( final Attachment att, final String mimetype ) {
+        // Default-deny: only passive content types which cannot execute script on the wiki's origin
+        // are served inline, so that user agents can try to automatically open them.  Everything
+        // else - including anything the container resolves to an actively rendering type such as
+        // text/html, application/xhtml+xml or image/svg+xml - is forced to download.
+        String contentDisposition = "attachment; filename=\"";
+        if( isInlineRenderSafe( mimetype ) && !m_engine.getManager( AttachmentManager.class ).forceDownload( att.getFileName() ) ) {
+            contentDisposition = "inline; filename=\"";
         }
         contentDisposition += att.getFileName() + "\";";
         return contentDisposition;
     }
 
+    /**
+     * Checks whether the given content type is safe to render inline on the wiki origin, i.e. it is a
+     * passive media type which cannot carry script.  Actively rendering types (text/html,
+     * application/xhtml+xml, image/svg+xml, XML, PDF, ...) are deliberately not on the allowlist.
+     *
+     * @param mimetype The resolved content type of the attachment.
+     * @return {@code true} if the attachment may be served with {@code Content-Disposition: inline}.
+     */
+    static boolean isInlineRenderSafe( final String mimetype ) {
+        if( mimetype == null ) {
+            return false;
+        }
+        final String type = mimetype.toLowerCase();
+        return INLINE_SAFE_TYPES.contains( type ) || type.startsWith( "audio/" ) || type.startsWith( "video/" );
+    }
+
     void sendError( final HttpServletResponse res, final String message ) throws IOException {
         try {
             res.sendError( HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message );

jspwiki-main/src/main/resources/ini/jspwiki.properties

@@ -182,7 +182,7 @@ jspwiki.attachment.provider = BasicAttachmentProvider
 
 # Attachment links to HTML, HTM and JS, etc. files will force a download rather than opening the attachment.
 # Set to * to always enforce attachment download
-jspwiki.attachment.forceDownload= .html .htm .js .pdf .svg .xml
+jspwiki.attachment.forceDownload= .html .htm .xhtml .xht .shtml .js .mjs .pdf .svg .svgz .xml .xsl .xslt .mht .mhtml
 
 #
 #  page Diff Representation

jspwiki-main/src/test/java/org/apache/wiki/attachment/AttachmentServletTest.java

@@ -0,0 +1,45 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wiki.attachment;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class AttachmentServletTest {
+
+    @Test
+    public void testActiveContentTypesAreNotInlineRenderSafe() {
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "text/html" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "application/xhtml+xml" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "image/svg+xml" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "application/xml" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "text/xml" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "application/pdf" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "application/javascript" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( "application/binary" ) );
+        Assertions.assertFalse( AttachmentServlet.isInlineRenderSafe( null ) );
+    }
+
+    @Test
+    public void testPassiveContentTypesAreInlineRenderSafe() {
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "image/png" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "image/jpeg" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "image/gif" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "text/plain" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "audio/mpeg" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "video/mp4" ) );
+        Assertions.assertTrue( AttachmentServlet.isInlineRenderSafe( "IMAGE/PNG" ) );
+    }
+
+}