fix(actions): drop untrusted Content-Encoding from v1 artifact uploads (#39855)

Legacy (v1 to v3) artifact uploads stored the request's
`Content-Encoding` header in the column that v4 artifacts read as their
`Content-Type`.

- Store only the `gzip` marker on legacy uploads, the only encoding
their clients send
- Pick the PDF and audio/video serve headers only for content types that
`mime.ParseMediaType` accepts

---------

Co-authored-by: silverwind <me@silverwind.io>

modules/httplib/serve.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"mime"
 	"net/http"
 	"path"
 	"strconv"
@@ -60,11 +61,13 @@ func serveSetHeaderContentRelated(w http.ResponseWriter, contentType string) {
 	header.Set("X-Content-Type-Options", "nosniff")
 
 	csp := serveHeaderCspDefault
-	if strings.HasPrefix(contentType, "application/pdf") {
-		csp = serveHeaderCspPdf
-	}
-	if strings.HasPrefix(contentType, "video/") || strings.HasPrefix(contentType, "audio/") {
-		csp = serveHeaderCspAudioVideo
+	if mediaType, _, err := mime.ParseMediaType(contentType); err == nil { // browsers may parse malformed types differently
+		if mediaType == "application/pdf" {
+			csp = serveHeaderCspPdf
+		}
+		if strings.HasPrefix(mediaType, "video/") || strings.HasPrefix(mediaType, "audio/") {
+			csp = serveHeaderCspAudioVideo
+		}
 	}
 	if csp != "" {
 		header.Set("Content-Security-Policy", csp)

modules/httplib/serve_test.go

@@ -117,9 +117,10 @@ func TestServeSetHeaderContentRelated(t *testing.T) {
 		{"", serveHeaderCspDefault},
 		{"any", serveHeaderCspDefault},
 		{"application/pdf", serveHeaderCspPdf},
-		{"application/pdf; other", serveHeaderCspPdf},
+		{"application/pdf; charset=binary", serveHeaderCspPdf},
 		{"audio/mp4", serveHeaderCspAudioVideo},
-		{"video/ogg; other", serveHeaderCspAudioVideo},
+		{"video/ogg; codecs=theora", serveHeaderCspAudioVideo},
+		{"video/mp4;,text/html", serveHeaderCspDefault},
 		{typesniffer.MimeTypeImageSvg, serveHeaderCspDefault},
 	}
 	for _, c := range cases {