Support rendering some media downloads as inline

changelog.d/15988.feature

@@ -0,0 +1 @@
+Render plain, CSS, CSV, JSON and XML media content in the browser (inline) when requested through the /download endpoint.

synapse/media/_base.py

@@ -50,6 +50,16 @@
     "text/xml",
 ]
 
+# A list of all content types that are "safe" to be rendered inline in a browser.
+INLINE_CONTENT_TYPES = [
+    "text/css",
+    "text/plain",
+    "text/csv",
+    "application/json",
+    "application/ld+json",
+    "text/xml",
+]
+
 
 def parse_media_id(request: Request) -> Tuple[str, str, Optional[str]]:
     """Parses the server name, media ID and optional file name from the request URI
@@ -155,7 +165,12 @@ def _quote(x: str) -> str:
 
     # Use a Content-Disposition of attachment to force download of media.
     disposition = "attachment"
-    if upload_name:
+
+    # We allow a strict subset of content types to be inlined
+    # so that they may be viewed directly in a browser.
+    if media_type.lower() in INLINE_CONTENT_TYPES:
+        disposition = "inline"
+    elif upload_name:
         # RFC6266 section 4.1 [1] defines both `filename` and `filename*`.
         #
         # `filename` is defined to be a `value`, which is defined by RFC2616

tests/media/test_base.py

@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from synapse.media._base import get_filename_from_headers
+from unittest.mock import Mock
+
+from synapse.media._base import add_file_headers, get_filename_from_headers
 
 from tests import unittest
 
@@ -36,3 +38,18 @@ def tests(self) -> None:
                 expected,
                 f"expected output for {hdr!r} to be {expected} but was {res}",
             )
+
+
+class AddFileHeadersTests(unittest.TestCase):
+    TEST_CASES = {
+        "text/plain": b"inline",
+        "text/xml": b"inline",
+        "text/html": b"attachment; filename=file.name",
+        "any/thing": b"attachment; filename=file.name",
+    }
+
+    def tests(self) -> None:
+        for media_type, expected in self.TEST_CASES.items():
+            request = Mock()
+            add_file_headers(request, media_type, 0, "file.name")
+            request.setHeader.assert_any_call(b"Content-Disposition", expected)