fix: the MIME type of an SVG file should be image/svg+xml

util/fsutil/file.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"io"
 	"mime/multipart"
-	"net/http"
 	"os"
 	"sync"
 
@@ -143,19 +142,16 @@ func (file *File) Save(fs WritableFS, path string, name string) (filename string
 func ParseMultipartFiles(headers []*multipart.FileHeader) ([]File, error) {
 	files := []File{}
 	for _, fh := range headers {
-		fileHeader := make([]byte, 512)
+		mimeType := "application/octet-stream"
 
 		if fh.Size != 0 {
 			f, err := fh.Open()
 			if err != nil {
 				return nil, errors.New(err)
 			}
-			if _, err := f.Read(fileHeader); err != nil {
-				_ = f.Close()
-				return nil, errors.New(err)
-			}
 
-			if _, err := f.Seek(0, 0); err != nil {
+			mimeType, err = DetectContentType(f, "")
+			if err != nil {
 				_ = f.Close()
 				return nil, errors.New(err)
 			}
@@ -166,7 +162,7 @@ func ParseMultipartFiles(headers []*multipart.FileHeader) ([]File, error) {
 
 		file := File{
 			Header:   fh,
-			MIMEType: http.DetectContentType(fileHeader),
+			MIMEType: mimeType,
 		}
 		files = append(files, file)
 	}

util/fsutil/fsutil.go

@@ -118,6 +118,8 @@ func GetMIMEType(filesystem fs.FS, file string) (contentType string, size int64,
 //
 // If the detected content type is `"application/octet-stream"` or `"text/plain"`, this function will attempt to
 // find a more precise one using `fsutil.DetectContentTypeByExtension`.
+// If the detected content type is `"text/xml"` or `"application/xml"`, this function promotes it to
+// `"image/svg+xml"` only if the content signature indicates SVG.
 // The header parameter is retained (e.g: `charset=utf-8`).
 //
 // If there is no error, this function always returns a valid MIME type. If it cannot determine a more specific one,
@@ -140,15 +142,46 @@ func DetectContentType(r io.Reader, fileName string) (string, error) {
 	contentType := http.DetectContentType(buffer)
 	if strings.HasPrefix(contentType, "application/octet-stream") || strings.HasPrefix(contentType, "text/plain") {
 		contentType = detectContentTypeByExtension(fileName, contentType)
+	} else if (strings.HasPrefix(contentType, "text/xml") || strings.HasPrefix(contentType, "application/xml")) && hasSVGSignature(buffer) {
+		contentType = "image/svg+xml"
 	}
 	return contentType, nil
 }
 
+func hasSVGSignature(buffer []byte) bool {
+	content := strings.TrimSpace(strings.ToLower(string(buffer)))
+	if after, ok := strings.CutPrefix(content, "\ufeff"); ok {
+		content = strings.TrimSpace(after)
+	}
+
+	for {
+		if strings.HasPrefix(content, "<?xml") {
+			end := strings.Index(content, "?>")
+			if end == -1 {
+				break
+			}
+			content = strings.TrimSpace(content[end+2:])
+			continue
+		}
+		if strings.HasPrefix(content, "<!--") {
+			end := strings.Index(content, "-->")
+			if end == -1 {
+				break
+			}
+			content = strings.TrimSpace(content[end+3:])
+			continue
+		}
+		break
+	}
+
+	return strings.HasPrefix(content, "<svg")
+}
+
 func detectContentTypeByExtension(fileName, contentType string) string {
 	for ext, t := range contentTypeByExtension {
 		if strings.HasSuffix(fileName, ext) {
 			tmp := t
-			if i := strings.Index(contentType, ";"); i != -1 {
+			if i := strings.Index(contentType, ";"); i != -1 && t != "image/svg+xml" {
 				tmp = t + contentType[i:] // Keep the "charset" arguments
 			}
 			contentType = tmp

util/fsutil/fsutil_test.go

@@ -239,6 +239,16 @@ func TestDetectContentType(t *testing.T) {
 			buf:      []byte{1, 2, 3},
 			wantMIME: "text/javascript",
 		},
+		{
+			fileName: "image.svg",
+			buf:      []byte("<?xml version=\"1.0\" encoding=\"UTF-8\"?><svg xmlns=\"http://www.w3.org/2000/svg\"></svg>"),
+			wantMIME: "image/svg+xml",
+		},
+		{
+			fileName: "script.js",
+			buf:      []byte("<?xml version=\"1.0\" encoding=\"UTF-8\"?><root></root>"),
+			wantMIME: "text/xml; charset=utf-8",
+		},
 		{
 			fileName: "eof",
 			buf:      []byte{},
@@ -300,6 +310,12 @@ func TestDetectContentTypeByExtension(t *testing.T) {
 			contentType: "text/plain; charset=utf-8",
 			fileName:    "test.css",
 		},
+		{
+			desc:        "utf8_svg",
+			want:        "image/svg+xml",
+			contentType: "text/xml; charset=utf-8",
+			fileName:    "image.svg",
+		},
 	}
 
 	for _, c := range cases {
@@ -309,6 +325,41 @@ func TestDetectContentTypeByExtension(t *testing.T) {
 	}
 }
 
+func TestHasSVGSignature(t *testing.T) {
+	cases := []struct {
+		desc string
+		buf  []byte
+		want bool
+	}{
+		{
+			desc: "direct_svg",
+			buf:  []byte("<svg xmlns=\"http://www.w3.org/2000/svg\"></svg>"),
+			want: true,
+		},
+		{
+			desc: "svg_with_prolog",
+			buf:  []byte("<?xml version=\"1.0\"?><svg></svg>"),
+			want: true,
+		},
+		{
+			desc: "svg_with_comment",
+			buf:  []byte("<?xml version=\"1.0\"?><!--comment--><svg></svg>"),
+			want: true,
+		},
+		{
+			desc: "xml_not_svg",
+			buf:  []byte("<?xml version=\"1.0\"?><root></root>"),
+			want: false,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.desc, func(t *testing.T) {
+			assert.Equal(t, c.want, hasSVGSignature(c.buf))
+		})
+	}
+}
+
 func TestFileExists(t *testing.T) {
 	assert.True(t, FileExists(&osfs.FS{}, toAbsolutePath("resources/img/logo/goyave_16.png")))
 	assert.False(t, FileExists(&osfs.FS{}, toAbsolutePath("doesn't exist")))
@@ -425,6 +476,69 @@ func TestParseMultipartFiles(t *testing.T) {
 		assert.NoError(t, err)
 	})
 
+	t.Run("svg", func(t *testing.T) {
+		svgPath := toAbsolutePath("util/fsutil/test.svg")
+		err := os.WriteFile(svgPath, []byte("<?xml version=\"1.0\" encoding=\"UTF-8\"?><svg xmlns=\"http://www.w3.org/2000/svg\"></svg>"), 0644)
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			deleteFile(svgPath)
+		})
+
+		form := createTestForm("util/fsutil/test.svg")
+		files, err := ParseMultipartFiles(form.File["file"])
+
+		expected := []File{
+			{
+				Header:   form.File["file"][0],
+				MIMEType: "image/svg+xml",
+			},
+		}
+		assert.Equal(t, expected, files)
+		assert.NoError(t, err)
+	})
+
+	t.Run("xml_content_with_js_extension", func(t *testing.T) {
+		filePath := toAbsolutePath("util/fsutil/test.js")
+		err := os.WriteFile(filePath, []byte("<?xml version=\"1.0\" encoding=\"UTF-8\"?><root></root>"), 0644)
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			deleteFile(filePath)
+		})
+
+		form := createTestForm("util/fsutil/test.js")
+		files, err := ParseMultipartFiles(form.File["file"])
+
+		require.NoError(t, err)
+		require.Len(t, files, 1)
+		assert.Equal(t, "text/xml; charset=utf-8", files[0].MIMEType)
+	})
+
+	t.Run("declared_content_type_separate_from_detected_mime", func(t *testing.T) {
+		body := &bytes.Buffer{}
+		writer := multipart.NewWriter(body)
+
+		headers := textproto.MIMEHeader{}
+		headers.Set("Content-Disposition", `form-data; name="file"; filename="custom.js"`)
+		headers.Set("Content-Type", "application/javascript")
+
+		part, err := writer.CreatePart(headers)
+		require.NoError(t, err)
+		_, err = part.Write([]byte("<?xml version=\"1.0\" encoding=\"UTF-8\"?><root></root>"))
+		require.NoError(t, err)
+		require.NoError(t, writer.Close())
+
+		reader := multipart.NewReader(body, writer.Boundary())
+		form, err := reader.ReadForm(math.MaxInt64 - 1)
+		require.NoError(t, err)
+
+		files, err := ParseMultipartFiles(form.File["file"])
+		require.NoError(t, err)
+		require.Len(t, files, 1)
+
+		assert.Equal(t, "application/javascript", files[0].Header.Header.Get("Content-Type"))
+		assert.Equal(t, "text/xml; charset=utf-8", files[0].MIMEType)
+	})
+
 	t.Run("empty_file", func(t *testing.T) {
 		headers := []*multipart.FileHeader{
 			{