-
Notifications
You must be signed in to change notification settings - Fork 118
Ensure external sources for styles only process CSS responses when inlining stylesheets #417
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| using PreMailer.Net.Extensions; | ||
| using System; | ||
| using System.IO; | ||
| using System.Net; | ||
|
|
@@ -8,7 +9,7 @@ namespace PreMailer.Net.Downloaders | |
| public class WebDownloader : IWebDownloader | ||
| { | ||
| private static IWebDownloader _sharedDownloader; | ||
|
|
||
| private const string CssMimeType = "text/css"; | ||
| public static IWebDownloader SharedDownloader | ||
| { | ||
| get | ||
|
|
@@ -29,8 +30,16 @@ public static IWebDownloader SharedDownloader | |
| public string DownloadString(Uri uri) | ||
| { | ||
| var request = WebRequest.Create(uri); | ||
| request.Headers.Add(HttpRequestHeader.Accept, CssMimeType); | ||
|
|
||
| using (var response = request.GetResponse()) | ||
| { | ||
| // We only support this operation for CSS file/content types coming back | ||
| // from the response. If we get something different, throw with the unsupported | ||
| // content type in the message | ||
| if(response.ParseContentType() != CssMimeType) | ||
| throw new NotSupportedException($"The Uri type is giving a response in unsupported content type '{response.ContentType}'."); | ||
|
|
||
|
Comment on lines
+37
to
+42
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm concerned this could have unintended consequences, since a response of actual CSS could be returned without setting the content type properly.
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thats a good shout, I'll have a think on how to approach it. The only thing I can currently think of is a manual check with a |
||
| switch (response) | ||
| { | ||
| case HttpWebResponse httpWebResponse: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| using System; | ||
| using System.Net; | ||
|
|
||
| namespace PreMailer.Net.Extensions | ||
| { | ||
| public static class WebResponseExtensions | ||
| { | ||
| public static string ParseContentType(this WebResponse response) | ||
| { | ||
| if(response == null) | ||
| throw new NullReferenceException("Malformed response detected when parsing WebResponse Content-Type"); | ||
|
|
||
| if(string.IsNullOrEmpty(response.ContentType)) | ||
| throw new NullReferenceException("Malformed Content-Type response detected when parsing WebResponse"); | ||
|
|
||
| var results = response.ContentType.Split(';'); | ||
|
|
||
| if(results.Length == 0) | ||
| throw new FormatException("Malformed Content-Type response detected when parsing WebResponse"); | ||
|
|
||
| return results[0]; | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would rather leave this out of the PR here. Perhaps there's another way to configure? Or add an exception to the anti-virus software?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like the idea of configuring it another way. I'll have a think about it, maybe some sort of
--safeModeflag or something? 🤔