Send .svg files as text/plain to prevent executable JS if they are loaded as SVG in the browser

services/clsi/app/coffee/ContentTypeMapper.coffee

@@ -6,7 +6,7 @@ Path = require 'path'
 module.exports = ContentTypeMapper =
 	map: (path) ->
 		switch Path.extname(path)
-			when '.txt', '.html', '.js', '.css'
+			when '.txt', '.html', '.js', '.css', '.svg'
 				return 'text/plain'
 			when '.csv'
 				return 'text/csv'
@@ -20,7 +20,5 @@ module.exports = ContentTypeMapper =
 				return 'image/tiff'
 			when '.gif'
 				return 'image/gif'
-			when '.svg'
-				return 'image/svg+xml'
 			else
 				return 'application/octet-stream'

services/clsi/test/unit/coffee/ContentTypeMapperTests.coffee

@@ -49,3 +49,7 @@ describe 'ContentTypeMapper', ->
 			it 'should map .jpeg to image/jpeg', ->
 				content_type = @ContentTypeMapper.map('example.jpeg')
 				content_type.should.equal 'image/jpeg'
+				
+			it 'should map .svg to text/plain to protect against XSS (SVG can execute JS)', ->
+				content_type = @ContentTypeMapper.map('example.svg')
+				content_type.should.equal 'text/plain'