reva bump 2.30.0

vendor/github.com/tus/tusd/v2/pkg/handler/unrouted_handler.go

@@ -34,7 +34,6 @@ const (
 var (
 	reForwardedHost  = regexp.MustCompile(`host="?([^;"]+)`)
 	reForwardedProto = regexp.MustCompile(`proto=(https?)`)
-	reMimeType       = regexp.MustCompile(`^[a-z]+\/[a-z0-9\-\+\.]+$`)
 	// We only allow certain URL-safe characters in upload IDs. URL-safe in this means
 	// that their are allowed in a URI's path component according to RFC 3986.
 	// See https://datatracker.ietf.org/doc/html/rfc3986#section-3.3
@@ -1104,7 +1103,10 @@ func (handler *UnroutedHandler) GetFile(w http.ResponseWriter, r *http.Request)
 	}
 
 	handler.sendResp(c, resp)
-	io.Copy(w, src)
+	if _, err := io.Copy(w, src); err != nil {
+		handler.sendError(c, err)
+		return
+	}
 
 	src.Close()
 }
@@ -1112,9 +1114,9 @@ func (handler *UnroutedHandler) GetFile(w http.ResponseWriter, r *http.Request)
 // mimeInlineBrowserWhitelist is a map containing MIME types which should be
 // allowed to be rendered by browser inline, instead of being forced to be
 // downloaded. For example, HTML or SVG files are not allowed, since they may
-// contain malicious JavaScript. In a similiar fashion PDF is not on this list
+// contain malicious JavaScript. In a similar fashion, PDF is not on this list
 // as their parsers commonly contain vulnerabilities which can be exploited.
-// The values of this map does not convey any meaning and are therefore just
+// The values of this map do not convey any meaning and are therefore just
 // empty structs.
 var mimeInlineBrowserWhitelist = map[string]struct{}{
 	"text/plain": {},
@@ -1125,14 +1127,17 @@ var mimeInlineBrowserWhitelist = map[string]struct{}{
 	"image/bmp":  {},
 	"image/webp": {},
 
-	"audio/wave":      {},
-	"audio/wav":       {},
-	"audio/x-wav":     {},
-	"audio/x-pn-wav":  {},
-	"audio/webm":      {},
-	"video/webm":      {},
-	"audio/ogg":       {},
-	"video/ogg":       {},
+	"audio/wave":     {},
+	"audio/wav":      {},
+	"audio/x-wav":    {},
+	"audio/x-pn-wav": {},
+	"audio/webm":     {},
+	"audio/ogg":      {},
+
+	"video/mp4":  {},
+	"video/webm": {},
+	"video/ogg":  {},
+
 	"application/ogg": {},
 }
 
@@ -1140,23 +1145,22 @@ var mimeInlineBrowserWhitelist = map[string]struct{}{
 // Content-Disposition headers for a given upload. These values should be used
 // in responses for GET requests to ensure that only non-malicious file types
 // are shown directly in the browser. It will extract the file name and type
-// from the "fileame" and "filetype".
+// from the "filename" and "filetype".
 // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
 func filterContentType(info FileInfo) (contentType string, contentDisposition string) {
 	filetype := info.MetaData["filetype"]
 
-	if reMimeType.MatchString(filetype) {
-		// If the filetype from metadata is well formed, we forward use this
-		// for the Content-Type header. However, only whitelisted mime types
-		// will be allowed to be shown inline in the browser
+	if ft, _, err := mime.ParseMediaType(filetype); err == nil {
+		// If the filetype from metadata is well-formed, we forward use this for the Content-Type header.
+		// However, only allowlisted mime types	will be allowed to be shown inline in the browser
 		contentType = filetype
-		if _, isWhitelisted := mimeInlineBrowserWhitelist[filetype]; isWhitelisted {
+		if _, isWhitelisted := mimeInlineBrowserWhitelist[ft]; isWhitelisted {
 			contentDisposition = "inline"
 		} else {
 			contentDisposition = "attachment"
 		}
 	} else {
-		// If the filetype from the metadata is not well formed, we use a
+		// If the filetype from the metadata is not well-formed, we use a
 		// default type and force the browser to download the content.
 		contentType = "application/octet-stream"
 		contentDisposition = "attachment"