fix: infer Content-Type from file extension when creating files

- Add getContentTypeFromExtension() helper with common MIME types
- Use extension-based content type instead of hardcoded text/plain
- Add aisafe.io to security acknowledgments (JWT_SECRET issue)

Author: adrgs

README.md

@@ -197,6 +197,7 @@ See [.env.example](.env.example) for all available options.
 
 Thank you to the following researchers for responsibly disclosing security issues:
 
+- [aisafe.io](https://aisafe.io) - Insecure JWT_SECRET default allowing token forgery
 - [debsec](https://x.com/deb_security) - LFI via improper path handling
 - [JaGoTu](https://infosec.exchange/@jagotu) - DoS via unrestricted file upload
 - [m0z](https://x.com/LooseSecurity) - LFI via session subdomain

frontend/src/components/file-tree/FileTree.tsx

@@ -19,6 +19,7 @@ import {
   renameInTree,
   deleteFromTree,
   getFilesInFolder,
+  getContentTypeFromExtension,
 } from "@/lib/fileTree";
 import type { FileTree as FileTreeType } from "@/types";
 
@@ -349,7 +350,10 @@ export function FileTree({
           raw: "", // Empty content
           headers: [
             { header: "Access-Control-Allow-Origin", value: "*" },
-            { header: "Content-Type", value: "text/plain" },
+            {
+              header: "Content-Type",
+              value: getContentTypeFromExtension(fullPath),
+            },
           ],
           status_code: 200,
         },

frontend/src/lib/fileTree.ts

@@ -179,6 +179,47 @@ export function deleteFromTree(files: FileTree, path: string): FileTree {
   return newFiles;
 }
 
+/**
+ * Get the Content-Type header value based on file extension
+ */
+export function getContentTypeFromExtension(filename: string): string {
+  const ext = filename.split(".").pop()?.toLowerCase() || "";
+  const mimeTypes: Record<string, string> = {
+    // Text/Code
+    html: "text/html; charset=utf-8",
+    htm: "text/html; charset=utf-8",
+    css: "text/css; charset=utf-8",
+    js: "text/javascript; charset=utf-8",
+    mjs: "text/javascript; charset=utf-8",
+    json: "application/json; charset=utf-8",
+    xml: "application/xml; charset=utf-8",
+    txt: "text/plain; charset=utf-8",
+    md: "text/markdown; charset=utf-8",
+    csv: "text/csv; charset=utf-8",
+    yaml: "text/yaml; charset=utf-8",
+    yml: "text/yaml; charset=utf-8",
+    // Images
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    svg: "image/svg+xml",
+    ico: "image/x-icon",
+    webp: "image/webp",
+    // Fonts
+    woff: "font/woff",
+    woff2: "font/woff2",
+    ttf: "font/ttf",
+    otf: "font/otf",
+    eot: "application/vnd.ms-fontobject",
+    // Other
+    pdf: "application/pdf",
+    zip: "application/zip",
+    wasm: "application/wasm",
+  };
+  return mimeTypes[ext] || "text/plain; charset=utf-8";
+}
+
 /**
  * Get unique folder paths from a FileTree
  */