MechaCat02 f39307232c fix: force download for untyped (octet-stream) served blobs ...

The /files handler served the application/octet-stream fallback with no
Content-Disposition, letting a browser render it inline — a stored-XSS vector if
the blob is crafted HTML/JS. Add Content-Disposition: attachment for that type
(belt to the existing nosniff); known image types stay inline.

Test (new tests/api_files.rs): octet-stream → attachment; png → inline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 20:15:23 +02:00

2.4 KiB

Raw Blame History

View Raw