github/deer-flow
1
0
Fork 0
mirror of https://github.com/bytedance/deer-flow.git synced 2026-09-25 14:06:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): classify Windows SVG MIME alias as active content (#5594)

Browse Source 
* fix(gateway): classify Windows SVG MIME alias as active content

Treat Windows' image/svg alias like the standard image/svg+xml active content type.

* test(gateway): cover Windows SVG MIME alias

Pin image/svg classification independently of the host MIME database.

* docs(utils): document platform MIME aliases

Record the shared active-content classification invariant.
This commit is contained in:
Lts1sds 2026-09-20 15:23:19 +08:00 committed by GitHub
parent 075f4a3607
commit 3fdf04597e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
backend/packages/harness/deerflow/utils/AGENTS.md
View File

@ -18,3 +18,10 @@ Tool and agent assembly re-enters `get_available_tools()` and may block on MCP d
optional leading UTF-8 BOM cannot hide a first-line heading or code fence, or
occupy a preview line. Preserve physical line numbers, embedded U+FEFF
characters, and the original file bytes.
### Active Content MIME Types
`text_detection.py::_is_active_content_mime_type` is the shared download-safety
boundary for artifacts and project documents. Keep platform aliases such as
Windows' `image/svg` aligned with their standard active type (`image/svg+xml`),
and preserve the generic `+xml` rule.

11
backend/packages/harness/deerflow/utils/text_detection.py
View File

@ -16,11 +16,12 @@ def is_text_file_by_content(path: Path, sample_size: int = 8192) -> bool:
return False
# Exact matches only; ``_is_active_content_mime_type`` also treats every
# Exact matches include platform MIME aliases; the helper also treats every
# ``+xml`` subtype as active content.
ACTIVE_CONTENT_MIME_TYPES = {
"text/html",
"application/xhtml+xml",
"image/svg",
"image/svg+xml",
"text/xml",
"application/xml",
@ -32,10 +33,10 @@ def _is_active_content_mime_type(mime_type: str | None) -> bool:
"""Return whether a browser can run script when rendering *mime_type* inline.
Beyond HTML, this covers every WHATWG XML MIME type (``text/xml``,
``application/xml``, or a ``+xml`` subtype) plus ``text/xsl``, which Blink
also renders as XML: any XML document can carry an XHTML-namespaced
``<script>``, so ``report.xml`` or ``feed.rss`` is as dangerous as
``page.html`` when opened in the application origin.
``application/xml``, or a ``+xml`` subtype), Windows' ``image/svg`` alias,
and ``text/xsl``, which Blink also renders as XML: any XML document can
carry an XHTML-namespaced ``<script>``, so ``report.xml`` or ``feed.rss``
is as dangerous as ``page.html`` when opened in the application origin.
"""
if mime_type is None:
return False

5
backend/tests/test_artifacts_router.py
View File

@ -626,6 +626,7 @@ def test_get_artifact_forces_download_for_any_xml_subtype(tmp_path, monkeypatch,
"text/html",
"application/xhtml+xml",
"image/svg+xml",
"image/svg",
"text/xml",
"application/xml",
"text/xsl",
@ -636,8 +637,8 @@ def test_get_artifact_forces_download_for_any_xml_subtype(tmp_path, monkeypatch,
],
)
def test_is_active_content_mime_type_covers_html_and_xml_documents(mime_type: str) -> None:
# Whether .rss or .atom guess to a +xml type depends on the host's
# mime.types file, so the classification is pinned on MIME types directly.
# MIME guesses depend on the host database (Windows uses image/svg), so
# classification is pinned on MIME types directly.
assert artifacts_router._is_active_content_mime_type(mime_type)