Content-Type is not defined in response headers for .map resources.

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.3.X, 7.4.3.37 CE GA37, 7.4.3.38 CE GA38, Master
• Component/s: Liferay Themes
• Labels:
  • 7.3.10-u10
  • 7.4.13-u37
  • Liferay-fixpack-dxp-10-7310
  • Liferay-update-update-dxp-10-7310
  • ee-ts
• Branch Version/s:
  7.3.x
• Backported to Branch:
  Committed

Background
This issue was spotted during a penetration test

Issue
Content-Type is not defined in response headers for .map resources
With no Content-Type defined, browser might load unexpected file formats and might be considered a security vulnerability.

Steps to reproduce

1. Start Liferay
2. Execute the following curl command and check the response header

   curl -I 'http://localhost:8080/o/classic-theme/css/main.css.map'
   curl -I 'http://localhost:8080/o/classic-theme/css/clay.css.map'

Actual result
Content-Type is not defined.

Expected result
Contains the appropriate Content-Type.

Reproduced in
DXP 7.3 update7
73x Commit: b0743fba0e99ebc4a4c8265b5ae5d430da376b5b
Master Commit: e09a23834186cfe4dc82e8d7de21702e146d98de