Be more strict when checking if mimetype is allowed inline

news/1167.bugfix

@@ -0,0 +1,2 @@
+Be more strict when checking if mimetype is allowed to be displayed inline.
+[maurits]

plone/namedfile/browser.py

@@ -1,4 +1,5 @@
 from AccessControl.ZopeGuards import guarded_getattr
+from plone.namedfile.utils import extract_media_type
 from plone.namedfile.utils import set_headers
 from plone.namedfile.utils import stream_data
 from plone.rfc822.interfaces import IPrimaryFieldInfo
@@ -174,7 +175,7 @@ class DisplayFile(Download):
 
     def set_headers(self, file):
         if hasattr(file, "contentType"):
-            mimetype = file.contentType
+            mimetype = extract_media_type(file.contentType)
             if self.use_denylist:
                 if mimetype in self.disallowed_inline_mimetypes:
                     # Let the Download view handle this.

plone/namedfile/scaling.py

@@ -11,6 +11,7 @@
 from plone.namedfile.interfaces import IStableImageScale
 from plone.namedfile.picture import get_picture_variants
 from plone.namedfile.picture import Img2PictureTag
+from plone.namedfile.utils import extract_media_type
 from plone.namedfile.utils import getHighPixelDensityScales
 from plone.namedfile.utils import set_headers
 from plone.namedfile.utils import stream_data
@@ -182,7 +183,7 @@ def _should_force_download(self):
         # If this returns True, the caller should call set_headers with a filename.
         if not hasattr(self.data, "contentType"):
             return
-        mimetype = self.data.contentType
+        mimetype = extract_media_type(self.data.contentType)
         if self.use_denylist:
             # We explicitly deny a few mimetypes, and allow the rest.
             return mimetype in self.disallowed_inline_mimetypes

plone/namedfile/utils/__init__.py

@@ -94,7 +94,11 @@ def safe_basename(filename):
 
 
 def get_contenttype(file=None, filename=None, default="application/octet-stream"):
-    """Get the MIME content type of the given file and/or filename."""
+    """Get the MIME content type of the given file and/or filename.
+
+    Note: depending on your use case, you may want to call 'extract_media_type'
+    on the result.
+    """
 
     file_type = getattr(file, "contentType", None)
     if file_type:
@@ -108,6 +112,22 @@ def get_contenttype(file=None, filename=None, default="application/octet-stream"
     return default
 
 
+def extract_media_type(content_type):
+    """extract the proper media type from *content_type*.
+
+    Ignore parameters and whitespace and normalize to lower case.
+    See https://github.com/zopefoundation/Zope/pull/1167
+    """
+    if not content_type:
+        return content_type
+    # ignore parameters
+    content_type = content_type.split(";", 1)[0]
+    # ignore whitespace
+    content_type = "".join(content_type.split())
+    # normalize to lowercase
+    return content_type.lower()
+
+
 def set_headers(file, response, filename=None):
     """Set response headers for the given file. If filename is given, set
     the Content-Disposition to attachment.