jamesfredley commented on PR #15801: URL: https://github.com/apache/grails-core/pull/15801#issuecomment-4997825811
Agreed - let's split this so the uncontested part isn't blocked on the debated one. Two independent changes are bundled here: 1. **Filename / content-disposition hardening** - you said you 100% agree on the filename fixes. This is straightforward security hygiene and can proceed. 2. **Changing the default content type** - this is the part worth discussing. Your concern is valid: defaulting to `text/plain` when the type is unknown can render encoder-produced non-text values incorrectly, and changing a render default is a behavior change that should go through the PR-summary policy with a documented case + weekly discussion. I'll separate the two: keep the filename/disposition hardening in this PR, and pull the default-content-type change out into its own proposal so we can make the case and discuss it in the weekly without holding up the agreed fixes. For the record (pre-release review): this PR is scoped to unsafe controller render defaults and is explicitly **not** the broader "GSP encode-by-default" topic (Google Doc 2.4) - that remains separate work. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
