fix: Ensure font serving does not reflect userdata-derived errors as HTML (#647)

* fix: ensure font serving does not reflect userdata-derived errors as HTML

Signed-off-by: Michael Nutt <michael@nuttnet.net>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tileserver-gl",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "tileserver-gl",
-      "version": "4.2.0",
+      "version": "4.2.1",
       "license": "BSD-2-Clause",
       "dependencies": {
         "@mapbox/glyph-pbf-composite": "0.0.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tileserver-gl",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Map tile server for JSON GL styles - vector and server side generated raster tiles",
   "main": "src/main.js",
   "bin": "src/main.js",

src/serve_data.js

@@ -54,7 +54,10 @@ export const serve_data = {
             if (/does not exist/.test(err.message)) {
               return res.status(204).send();
             } else {
-              return res.status(500).send(err.message);
+              return res
+                .status(500)
+                .header('Content-Type', 'text/plain')
+                .send(err.message);
             }
           } else {
             if (data == null) {

src/serve_font.js

@@ -54,7 +54,7 @@ export const serve_font = (options, allowedFonts) => {
         res.header('Last-Modified', lastModified);
         return res.send(concated);
       },
-      (err) => res.status(400).send(err),
+      (err) => res.status(400).header('Content-Type', 'text/plain').send(err),
     );
   });
 

src/serve_rendered.js

@@ -661,7 +661,10 @@ export const serve_rendered = {
           pool.release(renderer);
           if (err) {
             console.error(err);
-            return res.status(500).send(err);
+            return res
+              .status(500)
+              .header('Content-Type', 'text/plain')
+              .send(err);
           }
 
           // Fix semi-transparent outlines on raw, premultiplied input