XSS in cgit

[Jason A. Donenfeld]

On Jan 13, 2016 9:11 PM, "Eric Wong" <normalperson at yhbt.net> wrote:
>
> "Jason A. Donenfeld" <Jason at zx2c4.com> wrote:
> > Given all this, could somebody remind me why we have both /plain and
> > /blob handlers? And if it's still necessary to maintain a distinction?
> > If not, I will gladly accept patches to unify these.
>
> IIRC, the main difference was blob allows serving tree objects
> as-is in binary form while plain generates an HTML directory listing.

Thanks, this is what I thought, which leads me to the more relevant
question:

Given that the /blob handler returns binary directory data, it must conform
to a particular API in order to be useful. Was the recently removed
/blob/?mimetype= query string parameter part of such an API? Have we maimed
something useful?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/cgit/attachments/20160115/51f88745/attachment.html>