Jakub Zych 41a03b9987 fix(14.2): WR-03 uploads route sandboxes files and downloads non-images ...

The route answered with the blob's stored Content-Type, which attach.Store
sniffs from the bytes, so a public text upload starting with <html> was
served as text/html on the application origin; nosniff does not help when
the declared type is already HTML. Every response now carries a sandboxing
Content-Security-Policy, and a successful response whose type is not a
raster image (JPEG, PNG, GIF, WebP, AVIF) gets Content-Disposition:
attachment, on GET and HEAD. Covers stay inline.

2026-10-12 11:20:43 +02:00

5.3 KiB

Raw Blame History

View Raw