mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-05 13:29:44 +02:00
666193adf4
isInlineContentType is the security boundary that decides whether an uploaded file is served with Content-Disposition: inline (renderable in the document origin) or attachment. The SVG carve-out added in #3023 to block stored-XSS via uploaded .svg only matched the exact literal "image/svg+xml", so callers that supply "IMAGE/SVG+XML", "image/svg+xml; charset=utf-8", or whitespace-padded variants would still see disposition=inline. MIME type matching is case-insensitive per RFC 2045 §5.1 and may carry parameters, so the safe thing is to normalize at the boundary instead of trusting every caller. Today both call sites (S3.Upload and LocalStorage.Serve) happen to feed in the exact literal because the upload handler overrides .svg to "image/svg+xml" before storage sees it, so this is defense-in-depth rather than a live regression. Hardens the helper so any future caller (including one that ever trusts a client-supplied Content-Type) stays behind the same guard. Co-authored-by: multica-agent <github@multica.ai>